There is a path-sanitizing bug that affects daemon mode in all
recent rsync versions (including 2.6.2) but only if chroot is
disabled. It does NOT affect the normal send/receive filenames
that specify what files should be transferred. It does affect
certain option paths that cause auxiliary files to be read or
written.
http://rsync.samba.org/#security_aug04
25a514f29c