CVE-2026-109247 in FreeRDP
Summary
by MITRE • 10/12/2026
FreeRDP before 3.32.0 contains a path traversal vulnerability in convert_filedescriptors_to_file_list() in winpr/libwinpr/clipboard/synthetic_file.c, which concatenates server-supplied cFileName values from FileGroupDescriptorW clipboard data into the published local file:// URI without rejecting '/' or '..' sequences. A malicious RDP server can supply '../' sequences so the user's next clipboard paste copies an arbitrary local file readable by the client user instead of the expected remote file.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified in FreeRDP versions prior to 3.32.0 represents a critical path traversal flaw located within the synthetic_file.c module, specifically inside the convert_filedescriptors_to_file_list function. This component is responsible for processing clipboard data received from an RDP server during remote desktop sessions. The core technical deficiency lies in the insufficient validation of file names provided by the server-side application when constructing local file URIs. When a user copies content from a remote session, FreeRDP attempts to map this action to local files on the client machine to facilitate seamless integration between the remote and local environments. However, the implementation fails to sanitize or reject dangerous path traversal sequences such as forward slashes and double-dot notation within the cFileName values extracted from FileGroupDescriptorW clipboard data structures.
This lack of input validation allows a malicious RDP server to inject arbitrary directory navigation characters into the file name field. By supplying paths containing ../ sequences, an attacker can manipulate the resulting local file:// URI to point outside the intended sandboxed or expected directory structure. Consequently, when the user performs a paste operation on their local machine, instead of accessing the specific remote resource they requested, the system retrieves and exposes the contents of arbitrary files located anywhere in the client's filesystem that are readable by the current user account. This effectively bypasses isolation boundaries designed to prevent cross-session data leakage or unauthorized access to sensitive local configurations, credentials stored in plain text, or other private documents.
From a security impact perspective, this vulnerability enables an attacker with control over the RDP server to perform unauthorized file disclosure attacks against the client endpoint. The operational impact is significant as it relies on social engineering elements where the user must actively paste data from the clipboard, but once triggered, it provides direct access to local resources without further authentication or consent prompts beyond standard OS-level permissions. This aligns with CWE-22 Improper Limitation of a Pathname to a Restricted Directory and falls under ATT&CK technique T1005 Data from Local System which describes data staged in the local system for later exfiltration, although here it is used for immediate unauthorized access rather than staging. The vulnerability highlights risks associated with trusting unverified input from remote services when constructing file paths on the client side.
Mitigation strategies primarily involve upgrading to FreeRDP version 3.32.0 or later where this path traversal issue has been addressed through improved sanitization of clipboard data before URI construction. Organizations should enforce strict patch management policies for endpoints running RDP clients, particularly those connecting to untrusted or public remote desktop services. Additionally, implementing application whitelisting and restricting file system access permissions can reduce the blast radius if such a vulnerability is exploited in older versions that cannot be immediately patched. Security awareness training regarding clipboard operations from unknown sources remains relevant as users should remain cautious when pasting content received via RDP sessions into local applications.