CVE-2026-67295: FreeRDP before 3.29.0 Path Traversal via drive redirection
FreeRDP before 3.29.0 fails to properly validate server-supplied RDPDR paths in drive redirection, allowing attackers to access prefix-sibling paths outside the configured shared root. A malicious RDP server can read, write, delete, and enumerate files in sibling directories by sending non-rooted paths that bypass the shared-root boundary check.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.29.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-67295?
The severity of CVE-2026-67295 is medium with a score of 6.3.
How do I fix CVE-2026-67295?
To fix CVE-2026-67295, upgrade FreeRDP to version 3.29.0 or later which addresses the path traversal vulnerability.
What is the impact of CVE-2026-67295?
CVE-2026-67295 allows malicious RDP servers to access and manipulate files in sibling directories through improper validation of RDPDR paths.
Which versions of FreeRDP are affected by CVE-2026-67295?
FreeRDP versions before 3.29.0 are affected by CVE-2026-67295.
Is CVE-2026-67295 a critical vulnerability?
CVE-2026-67295 is classified as a medium severity vulnerability, not critical.