Yeah, I was just reading, thanks for sending the link. What I'm at so far, which is that you were able to successfully get a client to write outside of it's ex

Yeah, I was just reading, thanks for sending the link. What I'm at so far, which is that you were able to successfully get a client to write outside of it's expected root location using a 119 line python script as the server, is pretty problematic in itself if not yet fixed/mitigated in some way. :/ Did you event submit these finding as a bug? I would be interested in tracking this if it was accepted. It looks like this note from 3.1.2's release[1] is it, but I'm not sure: File-list validation in 3.1.2 December 21st, 2015 If you're using a version of rsync older than 3.1.2 as a client and receiving files from an rsync server that you might not fully trust, this version adds extra checking to the file list to prevent the sender from tweaking the paths and/or the transfer requests in a way that could cause a file to be received outside the transfer destination. 1: https://rsync.samba.org/security.html#s3_1_3 https://rsync.samba.org/security.html#s3_1_3