Seks99X

A path traversal issue exists when using --relative mode. A malicious sender can write files outside the intended destination directory tree by crafting relative paths containing symlink components. This occurs because the `make path()` function follows symlinks pointing outside the destination tree during the creation of intermediate directories without verifying that the resulting paths remain within the destination boundary, allowing arbitrary file writes on the receiver's filesystem.

An arbitrary file write issue exists where attackers can write files outside the intended destination tree. This occurs by specifying an absolute path through the `--temp-dir` or `--link-dest` options, which bypasses the rename-confinement logic. This allows attacker-controlled values to write files to any location accessible to the rsync process.

A time-of-check to time-of-use (TOCTOU) race condition exists in the non-daemon receiver's destination directory handling. This occurs when an attacker manipulates parent components of the destination path by substituting a symlink between the path resolution and the `chdir()` function call. This action causes the receiver's working directory to be established outside the intended destination tree, allowing subsequent relative-path file writes to be redirected to unintended filesystem locations.

An arbitrary file read issue exists due to improper symlink following during the handling of input configuration files. Attackers can read files accessible to the rsync daemon process by placing a symlink at a predictable path for `--files-from` or `--password-file`, or by providing a `--files-from` path that escapes the daemon module root. This affects the processing of `--files-from`, `--password-file`, and filter merge files.

A symlink following issue exists where local attackers can overwrite arbitrary files by placing a symbolic link at a predictable output path. This occurs because the software fails to reject symlinks during ancillary file writes, allowing output to be redirected to arbitrary filesystem locations. This can lead to local privilege escalation on installations where the software runs with elevated privileges, such as setuid or privileged daemon configurations. Affected output paths include `--log-file`, `--write-batch`, and daemon-mode log and statistics paths.

A path traversal issue exists where a malicious sender can escape the module root by exploiting symlinks within the module file tree. This occurs when using the `--partial-dir` or `--backup-dir` options. Attackers who can place a symlink under the module root, or leverage an existing trusted symlink, can direct file writes to locations outside the intended module root, resulting in arbitrary file write relative to the module root parent.