Rsync versions prior to 3.2.7-13.oe2403sp1 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers with write access to redirect file writes outside intended directories by exploiting symbolic links. This can lead to arbitrary file creation or overwriting, potentially modifying sensitive system files and enabling privilege escalation when the daemon runs with elevated privileges and chroot is disabled. Additionally, versions 3.4.2 and earlier have an authorization bypass vulnerability in hostname-based access control when chroot is enabled, allowing attackers to bypass deny rules via manipulated PTR records.