This CVE exposes a path traversal in rsync's make_path() function that activates only when the --relative flag is used. The vulnerability allows a malicious sender to craft paths containing symlinks that, when followed during recursive directory creation on the receiver, escape the intended destination directory. This is not a default-behavior vulnerability—the --relative flag must be explicitly enabled, which fundamentally changes the security posture of the transfer.
The critical insight here is that rsync's make_path() conflates two operations that should be separate: creating directories recursively and following symlinks. When you enable --relative, rsync interprets the sender's path structure as authoritative rather than treating it as untrusted input to be sandboxed. The function follows symlinks during intermediate directory creation without verifying that the resulting path remains within the destination boundary.
What should you do? First, audit every rsync command in your environment that uses --relative. Second, understand that --relative effectively grants the sender write access to your filesystem with only the nominal destination directory as the supposed boundary—the receiver does not enforce path containment after make_path() completes. Third, if you're synchronizing with untrusted senders, do not use --relative. Fourth, patch rsync to the latest version—this vulnerability was present in versions prior to 3.5.0.
The low EPSS score (0.00137) reflects that exploitation requires sender compromise, which narrows the threat significantly. However, rsync is embedded as a transfer backend in config management tools, container systems, and backup infrastructure where --relative is often the default. If your CI/CD pipeline, Ansible execution, or container registry uses rsync, treat this as a trust-boundary vulnerability: the moment an attacker can control what the sender transmits, they've gained filesystem write access beyond the destination tree.