Rsync versions from 2.3.3 up to and including 3.4.4 contain a path traversal vulnerability (CWE-22) that allows an attacker with write access to place or exploit symbolic links within the module file tree. When the --partial-dir or --backup-dir options are used, this can cause file writes to be redirected outside the module root directory, enabling arbitrary file writes relative to the parent of the module root. This vulnerability is identified as CVE-2026-70460 with a CVSS 4.0 score of 9.2, indicating critical severity.

An attacker with write access to the module root can exploit this vulnerability to write files outside the intended directory, potentially overwriting or creating files in arbitrary locations relative to the module root parent. This can lead to unauthorized file modification or system compromise depending on the context of the rsync usage.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict write access to the module root to trusted users only and avoid using the --partial-dir or --backup-dir options with untrusted senders. Monitor vendor advisories for updates and apply patches once released.