rsync prior to 3.5.0 is vulnerable to a symlink race condition that allows a privileged or local attacker to cause the sender to enumerate and transfer files outside the module root during directory scanning. The race condition occurs between an lstat() call and an opendir() call, enabling the attacker to replace a symlink with a directory pointing to a location outside the intended subtree. Successful exploitation can expose sensitive files beyond the rsync’s configured root, potentially leading to data disclosure.

RsyncProject’s rsync utility, versions prior to 3.5.0. All distributions that ship rsync v3.4.x or earlier are affected. The issue manifests in both daemon-mode (server side) and non-daemon sender-side scanning.

The CVSS score of 8.2 classifies this vulnerability as high severity. EPSS is not available, but the lack of a KEV listing indicates no publicly known exploits at the time of this analysis. The likely attack vector requires the ability to create or modify symlinks in a path component of the scanned tree; therefore the vulnerability is primarily exploitable by local users with write access to the directory being synchronized or by remote attackers who can influence the sender to scan a target path. Exploitation conditions also demand that the attacker act between the lstat() and opendir() calls, which is difficult to time, but the race condition is proven to exist.