Rsync versions prior to 3.5.0 contain a symlink race condition vulnerability in the --remove-source-files option. An attacker who can create symbolic links can atomically replace a source file with a symlink after the file transfer completes but before rsync calls unlink() to remove the source file. This causes rsync to delete the symlink target instead of the intended source file, enabling arbitrary file deletion.

An attacker with symlink creation privileges can exploit this vulnerability to delete arbitrary files on the system where rsync is running. This could lead to data loss or disruption of system operations depending on which files are deleted. There is no indication of privilege escalation or remote code execution from this vulnerability alone.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using the --remove-source-files option in untrusted environments or restrict symlink creation permissions for untrusted users to mitigate exploitation risk.