This vulnerability affects rsync versions up to 3.4.4 and stems from a TOCTOU race condition in the rrsync restricted shell wrapper. Authenticated users can escape directory restrictions by replacing a path component with a symlink after the initial validation but before the file transfer processing. Additionally, the use of unrestricted flags such as --copy-unsafe-links, -D, and --log-file through rrsync can be leveraged to access or modify files outside the permitted directory subtree, potentially leading to unauthorized file read or write operations.

Exploitation of this vulnerability allows authenticated attackers to bypass directory restrictions enforced by rrsync, potentially leading to unauthorized reading or writing of files outside the intended directory subtree. This can result in data exposure or modification beyond the scope of the restricted environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, restrict access to rrsync to trusted users only and avoid using unrestricted flags such as --copy-unsafe-links, -D, and --log-file with rrsync. Monitor vendor communications for updates on remediation.