Rsync versions before 3.5.0 contain a path confinement bypass that allows a remote client to escape the intended chroot boundary by using a \/. boundary marker in the module root; the vulnerability is identified as CWE-59. An attacker who can send specially crafted paths or a delta‑basis transfer referencing "xname" paths that cross the \/. boundary may read or write files outside the module’s subtree, potentially leading to privilege escalation or code execution if writable files are executed.

This issue affects all versions of RsyncProject rsync prior to 3.5.0 that use a chroot-based module configuration containing a \/. boundary marker – any system running rsync 3.4.x or earlier may be affected.

The CVSS score of 9.1 indicates high severity, and while EPSS data is not available, the lack of KEV listing does not reduce the risk. The likely attack vector is a remote rsync client that can connect to the rsync service, send a path containing \/. or a delta‑basis request that crosses the boundary, thereby gaining read or write access to files outside the intended directory. The vulnerability requires no local privileges and relies solely on network access to the rsync daemon.