https://rsync.samba.org/security.html#s3_1_2:

If you're using a version of rsync older than 3.1.2 as a client and
receiving files from an rsync server that you might not fully trust,
this version adds extra checking to the file list to prevent the sender
from tweaking the paths and/or the transfer requests in a way that could
cause a file to be received outside the transfer destination.

Signed-off-by: Maxim Storchak <m.storchak@gmail.com>