CyberRota Analysis
AI-GeneratedRsync versions prior to 3.5.0 are vulnerable to improper path handling, allowing attackers to manipulate --delete operations and potentially delete files outside the intended destination directory. This vulnerability can be exploited through crafted file lists that alter directory classifications or treat synthetic paths as the transfer root. Organizations using rsync for file synchronization, especially those with sensitive data, should prioritize patching to mitigate the risk of unauthorized data deletion.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operations beyond the intended destination subtree by sending a crafted file list that causes rsync to reclassify implied parent directory entries or treat synthetic paths as the transfer root. Attackers can exploit multiple variants including implied parent reclassification, synthetic root path construction, legacy protocol behavior below version 30, and non-directory root handling to cause the receiver to delete files outside the authorized destination directory.