PT-2026-34838 · Freerdp · Freerdp

Medoedus · Published 2026-04-24 · Updated 2026-05-21 · CVE-2026-40254

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.25.0

Description An off-by-one error exists in the path traversal filter within channels/drive/client/drive file.c. The contains dotdot() function fails to detect .. when it is the final component of a path without a trailing separator, although it correctly identifies ../ and .. mid-path. A malicious RDP server can exploit this to read, list, or write files one directory above the client's shared folder via RDPDR requests, provided the client connects with drive redirection enabled.

Recommendations Update to version 3.25.0.

Exploit

Fix

Weakness Enumeration

CWE-193

Related Identifiers

CVE-2026-40254

OPENSUSE-SU-2026:10832-1

Affected Products

Freerdp

References · 10

• 🔥 https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3xpj-m4hx-8vmx · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-40254 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-40254 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40254 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-40254 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-40254 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-40254 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10832-1 · Vendor Advisory
• https://suse.com/security/cve/CVE-2026-40254 · Note
• https://twitter.com/CVEnew/status/2048099331547287864 · Twitter Post