CVE-2026-67295 in FreeRDP
Summary
by MITRE • 08/01/2026
FreeRDP before 3.29.0 fails to properly validate server-supplied RDPDR paths in drive redirection, allowing attackers to access prefix-sibling paths outside the configured shared root. A malicious RDP server can read, write, delete, and enumerate files in sibling directories by sending non-rooted paths that bypass the shared-root boundary check.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/01/2026
This vulnerability represents a critical path traversal flaw in FreeRDP versions prior to 3.29.0 that affects the RDP drive redirection functionality. The issue stems from inadequate validation of server-supplied paths within the RDPDR (Remote Desktop Drive Redirection) component, which is responsible for managing file access between client and server during remote desktop sessions. When a malicious RDP server attempts to establish drive redirection, it can manipulate path specifications to escape the intended shared directory boundary. The vulnerability specifically occurs because the software fails to properly sanitize or validate paths that are not explicitly rooted, allowing attackers to construct relative paths that reference directories outside the configured shared root.
The technical implementation of this flaw involves the RDPDR subsystem's handling of file system operations where it should enforce strict boundaries around shared directories but instead accepts and processes non-rooted paths without proper validation. Attackers can exploit this by sending crafted path requests that use parent directory references such as "../" or similar traversal sequences, enabling them to access sibling directories and files that fall outside the intended sharing scope. This bypasses the normal security controls that should prevent unauthorized access to system resources beyond the configured shared root.
The operational impact of this vulnerability is significant as it allows attackers to perform full read, write, delete, and enumeration operations on files located in sibling directories relative to the configured shared root. An attacker who successfully exploits this vulnerability can gain access to sensitive data, modify critical system files, or even execute malicious code if they can place files in directories with appropriate permissions. This represents a privilege escalation vector that could allow an attacker to move laterally within a network environment where RDP connections are permitted and properly configured.
The vulnerability aligns with CWE-22 Path Traversal and follows patterns consistent with ATT&CK technique T1077.002 for remote access tools and T1566.001 for spearphishing attachments that could lead to initial compromise. Organizations using FreeRDP for remote desktop connections face a substantial risk if they do not implement proper mitigations, as this vulnerability can be exploited without requiring elevated privileges on the client system. The lack of proper path validation in the RDPDR component creates an attack surface that allows adversaries to bypass normal file system access controls and potentially gain access to sensitive information or system resources that should remain isolated.
The recommended mitigation approach involves upgrading FreeRDP to version 3.29.0 or later where this vulnerability has been addressed through proper path validation mechanisms. Network administrators should also consider implementing additional controls such as restricting RDP access to trusted networks, using network segmentation, and monitoring for suspicious RDP connection patterns. The fix typically involves implementing stricter path validation routines that ensure all paths processed by the RDPDR component remain within the designated shared directory boundaries, preventing any traversal outside the intended scope through careful sanitization of input paths before processing.