CVE-2026-40254: FreeRDP Path Traversal Vulnerability

CVE-2026-40254 Overview

CVE-2026-40254 is a path traversal vulnerability affecting FreeRDP, the free implementation of the Remote Desktop Protocol. The vulnerability stems from an off-by-one error in the path traversal filter within the drive redirection component. The flawed contains_dotdot() function in channels/drive/client/drive_file.c successfully catches ../ and ..\\ sequences in the middle of paths but fails to detect .. when it appears as the final component without a trailing separator.

A malicious RDP server can exploit this flaw to read, list, or write files one directory above the client's shared folder through crafted RDPDR (Remote Desktop Protocol: File System Virtual Channel Extension) requests. Successful exploitation requires the victim to connect to the attacker-controlled server with drive redirection enabled.

Critical Impact
A rogue RDP server can escape the client's shared folder boundary and access files in the parent directory, potentially exposing sensitive data or allowing unauthorized file modifications on the victim's system.

Affected Products

FreeRDP versions prior to 3.25.0
Systems with drive redirection enabled connecting to untrusted RDP servers
All platforms running vulnerable FreeRDP client implementations

Discovery Timeline

2026-04-24 - CVE-2026-40254 published to NVD
2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-40254

Vulnerability Analysis

This vulnerability is classified under CWE-193 (Off-by-one Error), a common programming mistake where boundary conditions are miscalculated by a single unit. In this case, the path validation logic fails to account for the edge case where the directory traversal sequence .. appears at the end of a path without a trailing directory separator.

The affected function contains_dotdot() is designed as a security control to prevent path traversal attacks in the RDPDR channel. When a client shares a drive or folder with the RDP server, this function validates incoming file operation requests to ensure they stay within the designated shared directory. The off-by-one error creates a bypass condition that allows an attacker to reference the parent directory.

The vulnerability requires user interaction, specifically the victim must initiate a connection to a malicious RDP server with drive sharing enabled. This is a client-side vulnerability where the attacker operates the server and manipulates the victim's client.

Root Cause

The root cause is an incomplete boundary check in the contains_dotdot() function located in channels/drive/client/drive_file.c. The function properly identifies and blocks path traversal sequences when followed by a directory separator (../ or ..\\), but the conditional logic does not handle the case where .. is the terminal component of the path string.

This off-by-one oversight allows crafted paths ending in .. (without a trailing / or \) to pass validation, enabling directory escape. The function likely checks for the separator character at position n+2 after detecting .., but when .. is at the string's end, no such character exists, causing the check to fail silently.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker must operate a rogue RDP server and convince a victim to connect with drive redirection enabled. The attack flow involves:

The victim initiates an RDP connection to a malicious server with drive sharing enabled (e.g., sharing C:\Users\victim\Documents)
The malicious server sends specially crafted RDPDR requests containing file paths ending in ..
The vulnerable contains_dotdot() function fails to detect the traversal sequence
The FreeRDP client processes the request, allowing file operations one directory above the shared folder (e.g., C:\Users\victim)
The attacker can read, list, or write files in the parent directory

The vulnerability allows escaping exactly one directory level above the shared folder boundary, enabling unauthorized access to files outside the intended scope.

Detection Methods for CVE-2026-40254

Indicators of Compromise

Unusual file access patterns involving paths ending with .. in RDP session logs
Unexpected file reads or writes in parent directories of shared RDP folders
Network traffic containing RDPDR requests with suspicious path components
Evidence of data exfiltration following RDP connections to unknown servers

Detection Strategies

Monitor FreeRDP client logs for file operation requests containing path traversal patterns
Implement network-level inspection of RDPDR channel traffic for anomalous path requests
Deploy endpoint detection rules to identify attempts to access files outside shared directory boundaries
Review connection logs for RDP sessions to untrusted or unknown server addresses

Monitoring Recommendations

Enable verbose logging in FreeRDP clients to capture detailed file operation requests
Implement file integrity monitoring on directories adjacent to commonly shared folders
Configure alerts for RDP connections to external or unrecognized server addresses
Monitor for any file system activity patterns consistent with directory traversal exploitation

How to Mitigate CVE-2026-40254

Immediate Actions Required

Upgrade FreeRDP to version 3.25.0 or later immediately
Disable drive redirection when connecting to untrusted RDP servers
Audit existing RDP connection configurations to identify unnecessary drive sharing
Review file access logs for evidence of potential exploitation

Patch Information

FreeRDP version 3.25.0 patches this vulnerability by correcting the off-by-one error in the contains_dotdot() function. The fix ensures that path traversal sequences are properly detected regardless of whether they appear mid-path or as the terminal component. Users should upgrade to the patched version as soon as possible.

For detailed patch information and release notes, refer to the FreeRDP Security Advisory on GitHub.

Workarounds

Disable drive redirection entirely when connecting to RDP servers by using the /drive parameter appropriately
Only connect to trusted, verified RDP servers when drive sharing is required
Use network segmentation to limit exposure of systems running vulnerable FreeRDP versions
Consider using alternative RDP clients until upgrade can be performed

bash

# Disable drive redirection when connecting with FreeRDP
xfreerdp /v:server.example.com /u:username -drive

# Or explicitly avoid sharing drives in connection command
xfreerdp /v:server.example.com /u:username /dynamic-resolution