CVE-2026-109247: FreeRDP before 3.32.0 Path Traversal via Clipboard cFileName

Q: What interaction is required for exploitation?

A malicious RDP server must provide crafted FileGroupDescriptorW clipboard data containing cFileName values with '../' sequences. The user must then perform the next clipboard paste operation.

Q: What could an attacker obtain through this issue?

The paste can copy an arbitrary local file that is readable by the FreeRDP client user, rather than the remote file the user expected to paste. The provided severity vector indicates confidentiality impact only.

Q: Which deployments are affected?

FreeRDP versions before 3.32.0 are affected. Systems connecting to untrusted or malicious RDP servers are the relevant exposure scenario described.

Published Oct 12, 2026

Updated

FreeRDP before 3.32.0 contains a path traversal vulnerability in convertfiledescriptorstofilelist() in winpr/libwinpr/clipboard/syntheticfile.c, which concatenates server-supplied cFileName values from FileGroupDescriptorW clipboard data into the published local file:// URI without rejecting '/' or '..' sequences. A malicious RDP server can supply '../' sequences so the user's next clipboard paste copies an arbitrary local file readable by the client user instead of the expected remote file.

Affected Software

1 affected component

FreeRDP freerdp<3.32.0

Event History

Oct 12, 2026

CVE Published

via MITRE·04:04 PM

Data Sourced

via MITRE·04:04 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Event

via NVD·06:11 PM

Frequently Asked Questions

What interaction is required for exploitation?

A malicious RDP server must provide crafted FileGroupDescriptorW clipboard data containing cFileName values with '../' sequences. The user must then perform the next clipboard paste operation.

What could an attacker obtain through this issue?

The paste can copy an arbitrary local file that is readable by the FreeRDP client user, rather than the remote file the user expected to paste. The provided severity vector indicates confidentiality impact only.

Which deployments are affected?

FreeRDP versions before 3.32.0 are affected. Systems connecting to untrusted or malicious RDP servers are the relevant exposure scenario described.

CVE-2026-109247: FreeRDP before 3.32.0 Path Traversal via Clipboard cFileName

Affected Software

Event History

Frequently Asked Questions

What interaction is required for exploitation?

What could an attacker obtain through this issue?

Which deployments are affected?

Company

Resources

Contact

Frequently Asked Questions

What interaction is required for exploitation?

What could an attacker obtain through this issue?

Which deployments are affected?