rsync versions before 3.5.0 can be driven by a remote client to read files outside the intended module root when the daemon runs without chroot and the module root or any component of it is a symbolic link. The daemon changes directory to the module root without resolving symlinks, so relative path requests such as "../etc/passwd" resolve to the target of the symlink, exposing arbitrary files to the client. The vulnerability is a classic path traversal flaw, able to leak sensitive data and potentially serve as a foothold for further attacks if the attacker can read privileged configuration or code files.

Any system running rsync as a server with a symlinked module root and with chroot disabled is affected. The issue applies to all official rsync releases prior to 3.5.0 from the RsyncProject. Upgrade to rsync 3.5.0 or later to remove the flaw.

The flaw carries a CVSS score of 8.4, indicating high severity. No EPSS value is publicly listed, and the vulnerability is not yet registered in the CISA KEV catalog. Attackers can exploit the weakness remotely by initiating a normal rsync session and requesting a relative path that traverses the symlinked root, assuming the client has network access to the rsync daemon and the root is not protected by chroot.