Rsync versions from 2.3.3 up to and including 3.4.4 contain a path traversal vulnerability (CWE-22) where an attacker with write access to place or exploit symlinks within the module file tree can escape the module root directory. This occurs when using the --partial-dir or --backup-dir options, allowing file writes outside the intended directory, potentially leading to arbitrary file write outside the module root parent directory.

An attacker able to place or exploit symlinks within the module root can cause rsync to write files outside the intended directory, potentially overwriting or creating files arbitrarily on the filesystem relative to the module root parent. This can lead to unauthorized file modification or system compromise. The CVSS 4.0 score is 9.2 (critical), indicating a high-severity remote vulnerability with no required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using rsync with --partial-dir or --backup-dir options in untrusted environments or where attackers may have write access to the module root. Restrict write permissions to trusted users only to prevent malicious symlink placement.