CVE-2026-73102: RustDesk Path Traversal via macOS Clipboard File-Paste

Q: Who is exposed to this issue?

RustDesk users on macOS running versions 1.3.9 through 1.4.9 are exposed when they use the clipboard file-paste feature in an active session with a remote peer.

Q: What does an attacker need to exploit it?

The attacker must be a remote peer in an active clipboard file-paste session and must be able to supply file descriptor names. Exploitation also requires user interaction, as indicated by the UI:R vector.

Q: What could successful exploitation allow?

A malicious peer can use parent-directory components or absolute paths in file descriptor names to write outside the directory selected by the user. Writes are limited to locations writable by the RustDesk process.

Q: What should be done if patching is not immediately possible?

Avoid using macOS clipboard file-paste with untrusted remote peers until the issue is remediated. This removes the affected code path from remote sessions.

Q: How is the issue fixed?

Commit 6f1eb16 fixes the vulnerability by validating file descriptor names and safely joining them to the selected target directory.

Published Aug 26, 2026

Updated

RustDesk versions 1.3.9 through 1.4.9 contain a path traversal vulnerability in the macOS clipboard file-paste code path. The application accepts peer-supplied file descriptor names and joins them to the selected target directory without requiring normalized relative paths. A remote peer in an active clipboard file-paste session can use parent-directory components or absolute paths to write files outside the intended target directory at locations writable by the RustDesk process. Commit 6f1eb16 fixes the issue by validating descriptor names and safely joining paths.

Affected Software

1 affected component

RustDesk>=1.3.9<=1.4.9

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade RustDesk (macOS clipboard file-paste) to a version that resolves this vulnerability.
Fixed in 1.4.9Patch 6f1eb16

Event History

Aug 26, 2026

CVE Published

via MITRE·01:00 PM

Data Sourced

via MITRE·01:00 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

RustDesk users on macOS running versions 1.3.9 through 1.4.9 are exposed when they use the clipboard file-paste feature in an active session with a remote peer.

What does an attacker need to exploit it?

The attacker must be a remote peer in an active clipboard file-paste session and must be able to supply file descriptor names. Exploitation also requires user interaction, as indicated by the UI:R vector.

What could successful exploitation allow?

A malicious peer can use parent-directory components or absolute paths in file descriptor names to write outside the directory selected by the user. Writes are limited to locations writable by the RustDesk process.

What should be done if patching is not immediately possible?

Avoid using macOS clipboard file-paste with untrusted remote peers until the issue is remediated. This removes the affected code path from remote sessions.

How is the issue fixed?

Commit 6f1eb16 fixes the vulnerability by validating file descriptor names and safely joining them to the selected target directory.

CVE-2026-73102: RustDesk Path Traversal via macOS Clipboard File-Paste

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What could successful exploitation allow?

What should be done if patching is not immediately possible?

How is the issue fixed?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What could successful exploitation allow?

What should be done if patching is not immediately possible?

How is the issue fixed?