rsync 2.3.3 through 3.4.0 contains a path traversal vulnerability that allows a malicious sender to escape the module root by exploiting symlinks when using --partial-dir or --backup-dir. By placing a symlink under the module or leveraging a trusted one, an attacker can redirect file writes outside the intended module directory, resulting in arbitrary file writes relative to the module root parent. This weakness enables modification of critical files on the server if the attacker has sufficient permission.

The vulnerability affects the rsync project’s rsync software from version 2.3.3 up to but not including 3.5.0. The impacted product is rsync as distributed by the RsyncProject, and all installations that run a vulnerable version and accept data via the --partial-dir or --backup-dir options are at risk. No specific operating system was identified, so any system running the affected rsync versions may be impacted.

The CVSS score is 9.2 indicating a high severity. EPSS is not available, but the lack of a KEV listing does not diminish the risk to exposed services. The likely attack vector is a remote attacker who can act as an rsync client with write access to the module root; the attacker then creates or hijacks a symlink to redirect writes. The weakness is CWE-22 (Path Traversal) and CWE-59 (Improper Restriction of Operations). If the server allows arbitrary uploads to the module directory the flaw can be exploited in a single connection, so the threat is high.