A time‑of‑check to time‑of‑use race condition exists in the rsync daemon that allows an attacker with write access to a module path to redirect a file write outside the intended directory by creating symbolic links in parent directories. When the daemon operates with elevated privileges, this flaw can be used to overwrite or create sensitive system files, thereby providing a path to privilege escalation. The weakness is classified as CWE‑367. The attack requires the daemon’s chroot setting to be disabled and the attacker must be able to write to the module path, making the attack surface limited to vulnerable rsync installations that expose writable modules and run in a non‑chrooted environment.

The rsync project’s rsync daemon, versions prior to 3.4.3. Any deployment of older rsync releases that exposes writable module paths and runs the daemon with elevated privileges is vulnerable.

The CVSS score of 7.3 indicates a high severity impact. Because no EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, the current exploitation probability is unknown but the flaw’s nature suggests it could be exploited in targeted scenarios where the conditions are met. The likely attack vector is remote access to the rsync daemon, involving manipulation of user‑supplied paths under the attacker’s control.