Skip to main content

FreeRDP CVE-2026-67295

| EUVDEUVD-2026-51817 MEDIUM
Path Traversal (CWE-22)
2026-08-01 VulnCheck GHSA-mx9v-6x7q-rjc2
Path Traversal Freerdp
5.3
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
5.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.3 MEDIUM

Network vector with required user interaction (client must initiate connection); attacker needs no privileges as they control the server; impact limited to partial client filesystem read/write/delete in sibling directories.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
SUSE
6.3 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Red Hat
6.3 MEDIUM
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
P
Scope
X

Lifecycle Timeline

2
Source Code Evidence Fetched
Aug 01, 2026 - 13:29 vuln.today
Analysis Generated
Aug 01, 2026 - 13:29 vuln.today

DescriptionCVE.org

FreeRDP before 3.29.0 fails to properly validate server-supplied RDPDR paths in drive redirection, allowing attackers to access prefix-sibling paths outside the configured shared root. A malicious RDP server can read, write, delete, and enumerate files in sibling directories by sending non-rooted paths that bypass the shared-root boundary check.

AnalysisAI

Path traversal in FreeRDP's RDPDR drive redirection channel (all versions before 3.29.0) enables a malicious RDP server to read, write, delete, and enumerate files on the client host outside the configured shared root directory. The server exploits absent boundary validation to supply non-rooted paths that escape to prefix-sibling directories - directories sharing a parent with the shared root but outside it. No public exploit code or CISA KEV listing has been identified; the vendor has released a fix in version 3.29.0.

Technical ContextAI

FreeRDP is an open-source implementation of Microsoft's Remote Desktop Protocol. The RDPDR (Remote Desktop Protocol Device Redirector) virtual channel allows RDP clients to expose local drives or directories to the remote server. When a client shares a path such as /home/user/shared, all server-initiated file operations should be confined within that root. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), where the implementation fails to reject or normalize non-rooted path strings supplied by the server, allowing traversal to sibling directories (e.g., /home/user/other_dir) without requiring a classic ../ sequence - the boundary check is bypassed entirely by omitting an absolute root anchor. CPE cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:* confirms the vulnerability spans all FreeRDP releases prior to 3.29.0 regardless of platform.

RemediationAI

Upgrade FreeRDP to version 3.29.0 or later, which includes the vendor-released patch referenced in commit 8d3b86022f0d71aefa7bd2e466d2d391693a41b3 and the security advisory at https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8xqm-wp3f-rfp9. If immediate upgrade is not feasible, disable drive and folder redirection in FreeRDP client settings (omit the /drive: argument or uncheck drive sharing in GUI-based wrappers such as Remmina) - this eliminates the RDPDR attack surface entirely at the cost of losing local-to-remote file sharing capability during sessions. As an additional control, restrict drive-redirected connections to a whitelist of trusted, internally managed RDP servers through network policy or VPN segmentation, preventing connections to attacker-controlled endpoints. VulnCheck advisory details are available at https://www.vulncheck.com/advisories/freerdp-before-path-traversal-via-drive-redirection.

More in Freerdp

View all
CVE-2026-25997 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_clipboard_format_equal before 3.23.0. Clipboard format comparison uses freed memory. Fifth

CVE-2026-25953 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_AppUpdateWindowFromSurface before 3.23.0. Surface-to-window update triggers memory corrupti
CVE-2026-25952 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_SetWindowMinMaxInfo before version 3.23.0. X11 client window management triggers memory cor
CVE-2026-25959 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_cliprdr_provide_data clipboard handling before 3.23.0. Clipboard data exchange triggers mem
CVE-2026-22857 CRITICAL POC
9.8 Jan 14

FreeRDP IRP thread handler has a use-after-free where the IRP is freed by Complete() then accessed on the error path. Fi
CVE-2026-22854 CRITICAL POC
9.8 Jan 14

FreeRDP drive read heap overflow when server-controlled read length exceeds IRP output buffer. Fixed in 3.20.1. PoC avai
CVE-2026-22852 CRITICAL POC
9.8 Jan 14

FreeRDP client before 3.20.1 has a heap buffer overflow in AUDIN format processing. A malicious RDP server can corrupt m
CVE-2026-25955 CRITICAL POC
9.8 Feb 25

Use-after-free in FreeRDP xf_AppUpdateWindowFromSurface before 3.23.0. Different code path from CVE-2026-25953. PoC and

CVE-2024-32041 CRITICAL POC
9.8 Apr 22

FreeRDP is a free implementation of the Remote Desktop Protocol. Rated critical severity (CVSS 9.8), this vulnerability

CVE-2023-40574 CRITICAL POC
9.8 Aug 31

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical
CVE-2023-40569 CRITICAL POC
9.8 Aug 31

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical
CVE-2023-40567 CRITICAL POC
9.8 Aug 31

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Rated critical

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0
CVE-2022-37042 CRITICAL POC
9.8

Same technique Path Traversal

View all
CVE-2019-19781 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8
CVE-2022-30333 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

CVE-2026-67295 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy