A vulnerability has been identified in rsync, the utility for file synchronization and backup (CVE-2022-29154), which allows an attacker-controlled rsync server to write or overwrite arbitrary files in the target directory on the user's side. A potential attack could also occur due to a man-in-the-middle (MITM) intervention in the transit traffic between the client and the legitimate server. The issue has been fixed in the test release of Rsync 3.2.5pre1.
The vulnerability is reminiscent of past issues in SCP and is also caused by the server's decision on the location of the written file, while the client fails to properly verify what the server provides against what was requested, allowing server files to be written that were not originally requested by the client. For example, when a user copies files to their home directory, server the server may deliver instead of the requested files, files with names like .bash_aliases or .ssh/authorized_keys, which will be saved in the user's home directory.
Source: opennet.ru
