An arbitrary file read issue exists due to improper symlink following during the handling of input configuration files. Attackers can read files accessible to the rsync daemon process by placing a symlink at a predictable path for `--files-from` or `--password-file`, or by providing a `--files-from` path that escapes the daemon module root. This affects the processing of `--files-from`, `--password-file`, and filter merge files.