CVE-2026-44509: CWE-59: Improper Link Resolution Before File Access ('Link Following') in RsyncProject rsync
CVE-2026-44509 is a vulnerability in rsync versions prior to 3.4.3 where improper handling of symbolic links in certain system calls (like chmod and chown) allows a local attacker to modify file attributes outside the intended export module when rsync daemon is configured with "use chroot = no". This issue was fixed in version 3.4.3. The vulnerability has a medium severity rating with a CVSS score of 6.3.
AI Analysis
Technical Summary
Rsync versions before 3.4.3 contain a vulnerability related to improper link resolution before file access, specifically in path-based system calls such as chmod() and chown(). Although previous fixes addressed symlink race conditions in open() calls, they missed these other system calls. When the rsync daemon is running with the configuration "use chroot = no", a local attacker with filesystem access can exploit this to change permissions, ownership, or timestamps on files outside the exported module. This vulnerability is tracked as CVE-2026-44509 and was resolved in rsync version 3.4.3.
Potential Impact
An attacker with local filesystem access can exploit this vulnerability to modify file permissions, ownership, or timestamps on files outside the intended export boundaries of the rsync daemon when "use chroot = no" is set. This could lead to unauthorized changes to critical files, potentially compromising system integrity or security. The confidentiality and integrity impacts are high, while availability is not affected.
Mitigation Recommendations
This vulnerability is fixed in rsync version 3.4.3. Users should upgrade to version 3.4.3 or later to remediate this issue. There is no official remediation level stated beyond the fix in 3.4.3. Until upgraded, avoid running the rsync daemon with "use chroot = no" if possible to reduce risk.
CVE-2026-44509: CWE-59: Improper Link Resolution Before File Access ('Link Following') in RsyncProject rsync
Description
CVE-2026-44509 is a vulnerability in rsync versions prior to 3.4.3 where improper handling of symbolic links in certain system calls (like chmod and chown) allows a local attacker to modify file attributes outside the intended export module when rsync daemon is configured with "use chroot = no". This issue was fixed in version 3.4.3. The vulnerability has a medium severity rating with a CVSS score of 6.3.
CVSS v3.1
Score 6.3medium
Affected software
pkg:github/rsyncproject/rsyncRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Rsync versions before 3.4.3 contain a vulnerability related to improper link resolution before file access, specifically in path-based system calls such as chmod() and chown(). Although previous fixes addressed symlink race conditions in open() calls, they missed these other system calls. When the rsync daemon is running with the configuration "use chroot = no", a local attacker with filesystem access can exploit this to change permissions, ownership, or timestamps on files outside the exported module. This vulnerability is tracked as CVE-2026-44509 and was resolved in rsync version 3.4.3.
Potential Impact
An attacker with local filesystem access can exploit this vulnerability to modify file permissions, ownership, or timestamps on files outside the intended export boundaries of the rsync daemon when "use chroot = no" is set. This could lead to unauthorized changes to critical files, potentially compromising system integrity or security. The confidentiality and integrity impacts are high, while availability is not affected.
Mitigation Recommendations
This vulnerability is fixed in rsync version 3.4.3. Users should upgrade to version 3.4.3 or later to remediate this issue. There is no official remediation level stated beyond the fix in 3.4.3. Until upgraded, avoid running the rsync daemon with "use chroot = no" if possible to reduce risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-06T18:28:20.887Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a5e8bb12a4a8d5989b8f5a6
Added to database: 07/20/2026, 20:57:21 UTC
Last enriched: 07/20/2026, 21:12:51 UTC
Last updated: 07/21/2026, 05:46:20 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.