S0S4

**Name of the Vulnerable Software and Affected Versions** rsync versions prior to 3.5.0 **Description** An arbitrary file read issue exists due to improper symlink following during the handling of input configuration files. Attackers can read files accessible to the rsync daemon process by placing a symlink at a predictable path for `--files-from` or `--password-file`, or by providing a `--files-from` path that escapes the daemon module root. This affects the processing of `--files-from`, `--password-file`, and filter merge files. **Recommendations** Update rsync to version 3.5.0 or later.