Rsync versions before 3.5.0 contain an improper path handling flaw that lets a malicious sender craft a file list to make the server delete files beyond the intended destination subtree. The vulnerability arises from reclassifying implied parent directories or treating synthetic paths as the transfer root, allowing attackers to delete files outside the authorized destination folder. This weakness is categorized as CWE-807, an improper restriction of operations within the bounds of a file, resulting in potential loss of critical data or configuration files on the remote host.

All rsync releases older than 3.5.0 are affected. The product is RsyncProject's rsync utility, with any version number preceding 3.5.0 on any of the supported operating systems.

The CVSS score of 7.1 indicates a high‑severity flaw, and while the EPSS score is not reported, the vulnerability is actively exploitable by a remote attacker who can connect to the rsync daemon and send a crafted file list. The flaw is not listed in the CISA KEV catalog, but the attack requires only inbound connectivity to the rsync service, making it likely to be attempted by attackers scanning for open rsync ports. Successful exploitation would allow deletion of arbitrary files on the target system, severely impacting data integrity and availability.