This vulnerability in rsync before version 3.5.0 arises from a TOCTOU race condition in the rrsync restricted shell wrapper. Authenticated users can escape directory restrictions by replacing a path component with a symlink after the initial validation but before the file transfer processing. The issue is exacerbated by the ability to use unrestricted flags such as --copy-unsafe-links, -D, and --log-file, which can be leveraged to access or modify files outside the permitted directory subtree.

Exploitation of this vulnerability allows authenticated attackers to bypass directory restrictions enforced by rrsync, potentially leading to unauthorized reading or writing of files outside the intended directory subtree. This could result in data exposure or unauthorized modification of files on the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to rrsync to trusted users only and avoid using unrestricted flags such as --copy-unsafe-links, -D, and --log-file in untrusted contexts.