csync2, when compiled using the C99 or later standard, creates temporary directories in an insecure manner. The use of these directories permits a time‑of‑check to time‑of‑use race condition, allowing an attacker who can influence the path or contents of the temporary directory to replace or manipulate files before they are accessed by csync2. This flaw could lead to arbitrary file overwrite or substitution, potentially compromising data integrity or allowing privilege escalation if the modified files are processed with elevated permissions. The flaw is documented as a moderate‑severity issue with a CVSS score of 5.1 and is not currently listed in the CISA KEV catalog.

SUSE openSUSE Tumbleweed users who compile or run csync2 with the C99 or later standard are affected. The vulnerability originates from the csync2 component installed on these systems; no specific version information is provided in the advisory.

The CVSS score indicates moderate risk, and the absence of an EPSS score means that no exploitation probability has been quantified. The flaw is not recorded in KEV, suggesting that there are no widely reported exploit cases at this time. However, the TOCTOU nature of the weakness means that a local attacker with the ability to influence the temporary directory could exploit it without network exposure. The lack of a publicly available patch or workaround implies that mitigations rely on configuration changes or future updates.