Out-of-tree metadata disclosure via unconfined directory enumeration

Path traversal in Rsync Project rsync before 3.5.0 allows attackers to disclose out-of-tree directory names, metadata, and symlink targets. The sender passes an accumulated path to plain opendir() instead of its secure resolver, permitting a raced or followed symlink to redirect enumeration outside the transfer root. Daemon exploitation requires a symlink-following mode and control of an in-module symlink; non-daemon exploitation requires racing a higher-authority sender that scans an attacker-controlled tree.