Rsync versions prior to 3.2.7-13.oe2403sp3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers with write access to a module path to redirect file writes outside intended directories by exploiting symbolic link replacements. This can lead to arbitrary file creation or overwriting, potentially modifying sensitive system files and enabling privilege escalation when the daemon runs with elevated privileges and chroot is disabled.