The vulnerability in rsync before version 3.5.0 arises from improper link resolution before file access (CWE-59). When the --temp-dir or --link-dest options are specified with absolute paths outside the destination tree, the rename-confinement logic is bypassed. This allows an attacker to write files arbitrarily outside the intended destination directory, potentially leading to unauthorized file modification or system compromise. The flaw affects all rsync versions up to and including 3.4.4.

An attacker can write files to arbitrary locations accessible by the rsync process, potentially overwriting critical system or application files. This could lead to privilege escalation, data corruption, or system compromise depending on the context in which rsync is run. The vulnerability does not require privileges or user interaction but does require the attacker to influence rsync command options.

No official patch or remediation level is currently confirmed. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using untrusted input for the --temp-dir or --link-dest options in rsync commands. Monitor vendor channels for updates and apply official patches once released.