Rsync under version 3.4.3 has a symlink race condition in numerous path‑based system calls such as chmod, lchown, utimes, rename, and others. The lack of atomic path resolution allows a local attacker who can influence the target path to shift a symlink during the short window between pathname verification and syscall execution, thereby applying permissions, ownership, timestamps, or filenames to files outside the exported rsync module. This flaw represents a classic race condition and an improper path handling weakness.

The vulnerability affects the RsyncProject rsync software. Versions 3.4.2 and all earlier releases are impacted; upgrading to version 3.4.3 or later removes the flaw.

The CVSS score of 7.2 indicates a high severity potential. EPSS data is unavailable, and the issue is not listed in the CISA KEV catalog. An attacker must run locally on the host with filesystem access to the rsync daemon and exploit the timing window while the daemon is configured with "use chroot = no". Successful exploitation can cause arbitrary file system changes, potentially escalating privileges or compromising data integrity.