Revampstudio

Authenticated clients can bypass module-level filter restrictions by providing malicious `--filter` merge file directives. During filter evaluation, attackers can inject client-side merge file directives to create rules that override the restrictions set by the daemon module, allowing unauthorized access to files that were intended to be excluded.

A newline injection issue exists in the name-converter uid/gid mapping interface. Local attackers can forge protocol messages by creating user or group names that include newline characters. By injecting these characters into names sent via the pipe-based line-oriented protocol, an attacker can trick the rsync daemon into treating malicious data as legitimate protocol input, which corrupts the uid/gid mapping logic.

Improper path handling allows a malicious sender to expand the scope of `--delete` operations beyond the intended destination subtree. By sending a crafted file list, an attacker can cause the receiver to reclassify implied parent directory entries or treat synthetic paths as the transfer root. This can be achieved through multiple methods, including implied parent reclassification, synthetic root path construction, non-directory root handling, and legacy protocol behavior below version 30, ultimately resulting in the deletion of files outside the authorized destination directory.

A privilege confusion issue exists in the name-converter subprocess uid/gid mapping. Local attackers can cause transferred files to be owned by root by influencing the name-converter responses to return empty values. When the subprocess returns an empty response for a uid or gid lookup, the software incorrectly interprets this as a successful resolution to uid/gid 0 (root) instead of a lookup failure. If the name-converter also signals fake super-user status, root ownership is assigned to the transferred files.