CyberRota Analysis
AI-GeneratedRsync versions prior to 3.5.0 are vulnerable to a symlink race condition that allows attackers to manipulate symlinks, enabling them to enumerate and transfer files outside the designated module root. This could lead to unauthorized data exposure during file transfers, impacting the confidentiality of sensitive information. Organizations using rsync for file synchronization, particularly those with untrusted users or environments, should prioritize patching to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's directory scanning logic that allows attackers to cause the sender to enumerate and transfer files outside the module root's intended subtree. Attackers who can create or manipulate symlinks in a path component of the scanned tree can replace a symlink with a directory entry pointing outside the module root between the lstat() call and the subsequent opendir() call, exposing files beyond the intended root in both daemon-mode and non-daemon sender-side scanning.