CVE-2026-67295

MEDIUM

FreeRDP before 3.29.0 Path Traversal via drive redirection

Title source: cna
STIX 2.1

Description

FreeRDP before 3.29.0 fails to properly validate server-supplied RDPDR paths in drive redirection, allowing attackers to access prefix-sibling paths outside the configured shared root. A malicious RDP server can read, write, delete, and enumerate files in sibling directories by sending non-rooted paths that bypass the shared-root boundary check.

References (3)

Core 3
Core References
Vendor Advisory vendor-advisory
GitHub Security Advisory (GHSA-8xqm-wp3f-rfp9)
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8xqm-wp3f-rfp9
Third Party Advisory third-party-advisory
VulnCheck Advisory: FreeRDP before 3.29.0 Path Traversal via drive redirection
https://www.vulncheck.com/advisories/freerdp-before-path-traversal-via-drive-redirection

Scores

CVSS v3 6.3
EPSS 0.0024
EPSS Percentile 15.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-22
Status published
Products (2)
FreeRDP/FreeRDP < 3.29.0
FreeRDP/FreeRDP 3.29.0
Published Aug 01, 2026
Tracked Since Aug 01, 2026