The vulnerability is a symlink race condition in rsync's --remove-source-files feature. During a transfer, an attacker can atomically replace a source file with a symlink pointing to an arbitrary target before rsync deletes the original. rsync then deletes the target file instead of the intended source file, granting attackers the ability to remove arbitrary files on the system that are accessible to the rsync process. This weakness matches CWE-367 and CWE-59 and results in loss of data integrity and availability.

RsyncProject rsync versions prior to 3.5.0 are affected, including the 3.4.x series and earlier releases.

The vulnerability has a CVSS score of 5.7, indicating moderate severity. The EPSS score is not publicly available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the ability to create symbolic links in the directory being synchronized, which typically means the attacker must have write or equivalent permissions to that location. If such access exists, the attacker can trigger the race condition with a single rsync invocation that uses the --remove-source-files option. The risk is therefore limited to environments where rsync is run with elevated privileges or where untrusted users can create files in the source directory.