rsync before version 3.5.0 contains a time‑of‑check to time‑of‑use race condition in the non‑daemon receiver’s destination directory handling. When an attacker can influence the parent components of the destination path, they can insert a symlink between the path resolution and the chdir() call, causing the receiver to change its working directory outside the intended destination tree. Subsequent relative‑path file writes are then directed to unintended filesystem locations, allowing overwriting or creation of arbitrary files on the target system.

The vulnerability affects the rsync product from RsyncProject for all versions older than 3.5.0.

The CVSS score of 5.8 indicates moderate severity. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector requires an attacker who can control the destination path supplied to rsync, typically a user who can execute rsync commands on the target system or an attacker who can influence the destination during a remote transfer. The exploit would allow arbitrary file writes, potentially leading to data tampering or privilege escalation if executed with elevated rights.