Skip to content

GHSA-mrc3-6cwx-hch6

CVE Information

A client-supplied merge-file filter (--filter=._<path> via --remote-option) was checked against the module-prefixed absolute path, which never matches a daemon rule anchored at the module root, so a forbidden merge file was loaded and its rules applied on the server side.

Fix: strip the module-dir prefix before the daemon-filter check, matching the existing --exclude-from/--include-from handling.

Test: daemon-filter-merge-bypass.

Credit: Mitchell Benjamin (Revamp Studio).

Affected: rsync 3.4.3 and earlier; fixed in 3.5.0. (Precise introduced-in ranges being finalised.)