An attacker can cause rsync to write files outside the intended destination tree by supplying absolute paths in the --temp-dir or --link-dest options. The vulnerability bypasses the rename‑confinement checks that normally restrict file modifications to the destination directory, allowing the attacker to overwrite or create files at any location reachable by the rsync process. This could lead to unauthorized modification of system files, installation of malware, or creation of back‑door persistence mechanisms, compromising integrity and potentially confidentiality depending on the target files.

The vulnerability affects all rsync releases prior to version 3.5.0. The official CWE identified for this flaw is 59 (Path Traversal). No specific sub‑products are singled out beyond the primary rsync utility provided by the RsyncProject.

The CVSS score of 7.2 indicates high severity. EPSS information is not supplied, and the flaw is not listed in the CISA KEV catalog. The likely attack vector is that an attacker who can influence the rsync command—either by controlling the client or by exploiting a remote rsync service—provides malicious --temp-dir or --link-dest arguments. This bypasses normal file‑write restrictions and permits the attacker to place files anywhere on the file system that the rsync process can reach. No additional exploitation prerequisites beyond the ability to command rsync are noted in the supplied description.