CyberRota Analysis
AI-GeneratedRsync versions prior to 3.5.0 are vulnerable to an arbitrary file write issue, allowing attackers to exploit the --temp-dir or --link-dest options to write files outside the intended destination. This vulnerability can lead to unauthorized file creation in arbitrary locations, potentially compromising system integrity and confidentiality. Organizations using affected versions of rsync should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination tree by specifying an absolute path via --temp-dir or --link-dest options. The rename-confinement logic is bypassed when these options resolve to paths outside the destination tree, enabling attacker-controlled values to write files to arbitrary locations accessible to the rsync process.