This is a pretty serious bug/vulnerability that’s been fixed in the latest version of rsync.
It allows a malicious server to write files to arbitrary locations on computer of the person downloading from that server.
As far as I can tell it doesn’t have a CVE.
I thought it was surprising because it’s such a serious vulnerability, and it has been open for a very long time. It seems to me very important that clients both upgrade their rsync version and consider the possibility of some sort of chroot to add extra security against something like this in future.
Disclosure on the rsync website:
The bug report and its follow up:
The writeup by Baidu security team:
The fix itself: