Buger

An arbitrary file write issue exists where attackers can write files outside the intended destination tree. This occurs by specifying an absolute path through the `--temp-dir` or `--link-dest` options, which bypasses the rename-confinement logic. This allows attacker-controlled values to write files to any location accessible to the rsync process.

An arbitrary file read issue exists due to improper symlink following during the handling of input configuration files. Attackers can read files accessible to the rsync daemon process by placing a symlink at a predictable path for `--files-from` or `--password-file`, or by providing a `--files-from` path that escapes the daemon module root. This affects the processing of `--files-from`, `--password-file`, and filter merge files.

An access control bypass exists that allows remote attackers to circumvent hosts deny rules by inducing DNS resolution failures during hostname-based access control evaluation. When a DNS lookup for a hostname-based deny rule fails, the daemon skips the rule instead of defaulting to a deny decision. This allows attackers to bypass module-level IP access controls and gain unauthorized access to restricted module file trees.

A signed integer overflow exists in the I/O timeout implementation. An attacker can inject `MSG IO TIMEOUT` messages containing non-positive values (zero or negative), causing the timeout variable to wrap. This prevents the timeout check from triggering, allowing idle or stalled connections to occupy daemon slots indefinitely, which results in resource exhaustion.