CVE-2026-2490 in RustDesk
Summary
by MITRE • 02/21/2026
RustDesk Client for Windows Transfer File Link Following Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of RustDesk Client for Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the Transfer File feature. By uploading a symbolic link, an attacker can abuse the service to read arbitrary files. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-27909.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 02/22/2026
This vulnerability represents a critical information disclosure flaw in the RustDesk Client for Windows implementation that stems from improper handling of file transfer operations. The vulnerability specifically affects the Transfer File feature functionality and allows local attackers with low-privileged code execution capabilities to extract sensitive information from the target system. The flaw manifests when the client processes symbolic link uploads, creating an exploitable condition that enables arbitrary file reading operations. The vulnerability has been assigned the identifier ZDI-CAN-27909 and represents a significant security risk for systems running affected RustDesk client versions. The root cause of this vulnerability lies in the insufficient validation and sanitization of file paths during the transfer process, particularly when symbolic links are involved in the file handling workflow.
The technical exploitation of this vulnerability occurs through a carefully crafted symbolic link upload that abuses the client's file processing logic. When the RustDesk client encounters such a symbolic link during file transfer operations, it fails to properly resolve the link's target path, instead allowing the attacker to traverse the file system and access files that should otherwise be restricted. This behavior creates a path traversal condition that operates at the system level, as the vulnerability can be leveraged to disclose information in the context of SYSTEM privileges. The flaw essentially bypasses normal file access controls and permission boundaries, enabling attackers to read files that typically require elevated privileges to access. The vulnerability's impact is particularly concerning because it operates within the client application's file handling mechanism rather than requiring network-based exploitation, making it more difficult to detect and prevent through traditional network security measures.
The operational impact of this vulnerability extends beyond simple information disclosure, as it provides attackers with the ability to access sensitive system files, configuration data, and potentially credentials stored within the file system. The fact that this vulnerability can be exploited to read files in the SYSTEM context means that attackers can access highly privileged information including but not limited to system configuration files, user credentials, application data, and other sensitive operational information. This vulnerability essentially creates a backdoor for attackers to gather intelligence about the target system, potentially enabling further exploitation attempts such as privilege escalation, lateral movement, or data exfiltration. The local execution requirement means that attackers must first compromise the system through other means, but once achieved, this vulnerability provides a powerful information gathering capability that significantly amplifies the impact of initial compromise. According to CWE standards, this vulnerability maps to CWE-22 Path Traversal and CWE-200 Information Exposure, with the ATT&CK framework classification falling under T1083 File and Directory Discovery and T1566 Phishing with Malicious Attachment techniques.
Mitigation strategies for this vulnerability should focus on both immediate remediation and long-term architectural improvements to prevent similar issues. The most effective immediate solution involves applying the vendor-provided security patch or update that addresses the symbolic link handling within the Transfer File feature. Organizations should also implement network segmentation and access controls to limit local execution capabilities and reduce the attack surface. Additionally, system administrators should conduct thorough file system audits to identify and remove any symbolic links that could be exploited, particularly in directories accessible to low-privileged users. Implementing proper file access controls and privilege separation measures can help limit the potential damage from this vulnerability. The ATT&CK framework suggests implementing process monitoring and endpoint detection capabilities to identify suspicious file transfer activities and symbolic link creation events. Regular security assessments and vulnerability scanning should include checks for similar path traversal vulnerabilities in other software components, as this represents a common class of flaws that can be exploited across various applications and systems.