A flaw in rsync versions prior to 3.5.0 permits an authenticated client to supply malicious merge directives that override module‑level filter rules. By injecting its own directives during filter evaluation, an attacker can add rules that supersede the intended restriction, thereby gaining read access to files that should have been excluded. This reflects a missing enforcement of access control (CWE‑863) and can lead to confidential data exposure.

All installations of rsync produced by RsyncProject running a version older than 3.5.0 are affected. Any server that exposes a module with filter restrictions and accepts authenticated clients is at risk.

The CVSS score of 6.9 indicates a moderate severity. EPSS data are not available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires an authenticated connection to the rsync daemon, and the attacker must be able to supply or influence the --filter merge directive. Given the lack of exploitation evidence, the likelihood is moderate, but the potential to read protected files makes the impact significant.