rsync before version 3.5.0 contains a symlink‑following flaw that allows a local attacker to overwrite arbitrary files by directing rsync to write output through a predictable symlink. The vulnerability arises when rsync is asked to write to paths such as --log-file, --write-batch, or daemon‑mode log and statistics, and the program fails to reject symlinks during these ancillary writes. The result can be the replacement of critical system files when rsync runs with elevated privileges, thereby enabling local privilege escalation. The weakness is classified as CWE‑59.

The flaw affects all releases of the RsyncProject rsync client older than version 3.5.0 on any operating system that installs rsync in a set‑uid or privileged daemon mode. This includes most Linux and Unix‑like distributions that use rsync in a privileged context. No additional version constraints are provided beyond the <3.5.0 boundary, so any build before that release is considered vulnerable.

The CVSS score of 8.5 flags high severity, and while the EPSS score is not disclosed, the attack requires local access and the presence of elevated privileges, conditions that are common on servers running rsync with set‑uid binaries or as a privileged daemon. The vulnerability is not listed in the CISA KEV catalog, indicating no documented large‑scale exploitation yet, but once exploited an attacker could replace arbitrary files and potentially gain full system control. The likely attack vector involves a local user creating a symlink to a target file and executing rsync with the vulnerable option so that the file is overwritten.