The vulnerability in rsync arises from the --inc-recursive option's handling of symbolic links and deduplication during file synchronization. Because the server can enable this option even if not explicitly requested by the client, and due to insufficient symlink verification, a malicious server can cause rsync to write files outside the client's intended directory. This path traversal can lead to unauthorized file writes and potential integrity compromise on the client system. The issue affects multiple architectures and versions of Red Hat Enterprise Linux. Red Hat has issued security advisories and updates that fix this vulnerability by rebuilding rsync with appropriate safeguards.

An attacker controlling a malicious rsync server can exploit this vulnerability to write files to arbitrary locations on the client system outside the intended synchronization directory. This can lead to integrity violations by placing malicious files in sensitive locations. The CVSS vector indicates no impact on confidentiality or availability, but a high impact on integrity. There are no reports of active exploitation in the wild at this time.

Official patches are available from Red Hat for affected versions of Red Hat Enterprise Linux 9.4 and 10. Users should apply these updates promptly to remediate the vulnerability. The advisories provide detailed instructions and updated package versions. No additional mitigation is required beyond applying the vendor-provided fixes.