rsync before version 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read any file accessible to the rsync daemon by exploiting symlink following in configuration handling. The flaw appears in several input modes such as --files-from, --password-file, and filter merge files, a weakness that maps to CWE-61. The attack can expose sensitive data on the system, causing a confidentiality breach without requiring local privileges.

The affected product is rsync from RsyncProject; all releases prior to 3.5.0 are vulnerable. This includes any deployment where the rsync daemon serves files and accepts --files-from or --password-file options, as well as configurations that merge filter files.

The CVSS score of 8.4 reflects a high‑severity risk. The EPSS score is not available, so the likelihood of exploitation at the present moment is unclear, and the vulnerability is not listed in the CISA KEV catalog. Attackers can leverage the vulnerability remotely by sending specially crafted options to the rsync service or by placing a symlink at a predictable path used by the daemon. Exploitability therefore depends on network exposure of the rsync daemon and the ability to influence its input configuration.