The defect is in rsync's make_path() routine when the --relative flag is active. A malicious sender can craft a relative path that includes symlink components pointing outside the intended destination tree. When the receiver processes such a transfer, the function follows the symlinks while creating intermediate directories, writing files to arbitrary locations, which can overwrite system files, execute malicious code, or subvert configuration.

RsyncProject's rsync utility versions older than 3.5.0 are affected. This includes the 3.4.x series and earlier releases.

The CVSS score of 6.9 indicates moderate severity. The flaw can be exploited remotely by a sender that has permission to initiate a transfer with --relative mode, which is typically allowed by the rsync protocol. EPSS data is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting that it is not actively exploited in the wild, yet the path‑traversal write capability remains a significant risk. Limiting the use of –relative mode or restricting the service to trusted hosts can reduce the likelihood of successful exploitation.