CyberRota Analysis
AI-GeneratedRsync versions prior to 3.5.0 are vulnerable to a path traversal issue that permits remote clients to access files outside the designated module root when chroot is disabled and symlinks are involved. This flaw arises from the daemon's failure to resolve symlinks during session initialization, leading to unauthorized file access. Organizations using rsync in environments where symlinks are present should prioritize patching to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir() to the module root at session initialization without resolving symlinks via realpath() or equivalent, causing subsequent relative-path operations to reference files relative to the symlink target rather than the intended module root, enabling unauthorized file access.