CyberRota Analysis
AI-GeneratedRsync versions prior to 3.5.0 are vulnerable to a path confinement bypass that enables remote clients to escape the intended chroot environment, potentially allowing unauthorized access to files outside the designated directory. Attackers can exploit this flaw by manipulating path notations or forging delta-basis transfers, leading to significant security risks. Organizations using affected versions of rsync should prioritize patching to mitigate the risk of unauthorized data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing paths that resolve outside the chroot boundary when the module root contains a /./ boundary marker. Attackers can exploit improper handling of the /./ notation or forge delta-basis transfers referencing xname paths that cross the /./ boundary to gain unauthorized read or write access to files outside the module's subtree.