CVE-2026-67295: FreeRDP Path Traversal Vulnerability

CVE-2026-67295 Overview

CVE-2026-67295 is a path traversal vulnerability [CWE-22] in FreeRDP before version 3.29.0. The flaw resides in the RDPDR (Remote Desktop Protocol Device Redirection) drive redirection component, which fails to properly validate server-supplied paths. A malicious RDP server can send non-rooted paths that bypass the shared-root boundary check, allowing access to prefix-sibling directories outside the configured share.

An attacker controlling a rogue RDP server can read, write, delete, and enumerate files in sibling directories on a connecting client. Exploitation requires user interaction because the victim must initiate an RDP session to the attacker-controlled server.

Critical Impact
A malicious RDP server can read, write, delete, and enumerate files outside the shared drive root on client systems that connect to it, resulting in confidentiality and integrity loss on the client host.

Affected Products

FreeRDP versions prior to 3.29.0
Applications and distributions bundling vulnerable FreeRDP libraries
Any RDP client using FreeRDP with drive redirection enabled

Discovery Timeline

2026-08-01 - CVE-2026-67295 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-67295

Vulnerability Analysis

The RDPDR channel in FreeRDP supports drive redirection, which exposes a client-side directory to the remote RDP server as a virtual drive. The client is expected to constrain all server-supplied file operations to a configured shared root. In vulnerable builds prior to 3.29.0, the path validation logic did not correctly reject non-rooted paths whose textual prefix resembled but did not equal the shared-root path.

This boundary check flaw permits path traversal to sibling directories that share a common prefix with the intended share. Because the RDP server drives the file operation requests, a malicious or compromised server can enumerate, read, modify, or delete files in those adjacent locations. The vulnerability is tracked as CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Root Cause

The underlying defect is a prefix-based comparison used to enforce the shared-root containment invariant. A path such as /home/user/share_extra shares the textual prefix /home/user/share but is not a child of /home/user/share. The check accepted these prefix-sibling paths and forwarded them to the file I/O layer without additional normalization or containment verification.

Attack Vector

Exploitation requires a victim to initiate an RDP session, with drive redirection enabled, to an attacker-controlled server. Once connected, the server sends crafted RDPDR requests referencing non-rooted paths that resolve outside the shared drive boundary. The FreeRDP client honors these requests and performs file operations against the attacker-specified locations under the current user's privileges.

// Excerpt from the upstream security patch
// Source: https://github.com/FreeRDP/FreeRDP/commit/8d3b86022f0d71aefa7bd2e466d2d391693a41b3

Stream_Read_UINT16(s, *orderType);   /* orderType (2 bytes) */
Stream_Read_UINT16(s, *orderLength); /* orderLength (2 bytes) */
if (*orderLength < RAIL_PDU_HEADER_LENGTH)
{
    WLog_ERR(TAG, "invalid order length %" PRIu16 " < RAIL_PDU_HEADER_LENGTH(%u)", *orderLength,
             RAIL_PDU_HEADER_LENGTH);
    return ERROR_INVALID_DATA;
}

if (!Stream_CheckAndLogRequiredLength(TAG, s, *orderLength - RAIL_PDU_HEADER_LENGTH))
    return ERROR_INVALID_DATA;

if (*orderLength > RAIL_PDU_MAX_LENGTH)
{
    WLog_ERR(TAG, "invalid order length %" PRIu16 " < RAIL_PDU_MAX_LENGTH(%llu)", *orderLength,
             RAIL_PDU_MAX_LENGTH);
    return ERROR_INVALID_DATA;
}

return CHANNEL_RC_OK;

The patched commit introduces additional length and boundary validation across affected channels. See the FreeRDP GitHub Security Advisory GHSA-8xqm-wp3f-rfp9 for the full advisory.

Detection Methods for CVE-2026-67295

Indicators of Compromise

Outbound RDP connections from user workstations to untrusted or previously unseen external hosts on TCP 3389.
FreeRDP client processes performing file operations on paths outside the user-configured share directory.
Unexpected file creation, modification, or deletion in directories that are prefix-siblings of a shared RDP drive path.
FreeRDP client log entries referencing RDPDR path resolution errors or unusual file handles.

Detection Strategies

Inventory installed FreeRDP versions across Linux, macOS, and Windows endpoints and flag installations below 3.29.0.
Correlate outbound RDP sessions with subsequent local filesystem changes in the user's home directory outside the declared share path.
Monitor process telemetry for xfreerdp, wlfreerdp, and downstream applications that link against libfreerdp invoking drive redirection.

Monitoring Recommendations

Alert on RDP client sessions to external or non-corporate destinations, particularly where drive redirection command-line flags such as /drive: are present.
Log and review filesystem writes performed by RDP client processes and compare against the configured share root.
Enable verbose FreeRDP channel logging in sensitive environments to capture RDPDR path parameters for later review.

How to Mitigate CVE-2026-67295

Immediate Actions Required

Upgrade FreeRDP to version 3.29.0 or later on all affected systems.
Update downstream packages and applications that bundle FreeRDP, including Linux distribution packages and third-party remote desktop clients.
Restrict outbound RDP connectivity to trusted, well-known internal destinations at the network perimeter.
Instruct users not to initiate RDP sessions to untrusted or unsolicited endpoints.

Patch Information

The fix is included in FreeRDP 3.29.0. Review the upstream commit 8d3b8602, the FreeRDP GHSA-8xqm-wp3f-rfp9 advisory, and the VulnCheck advisory for full remediation details.

Workarounds

Disable drive redirection when connecting to RDP endpoints by omitting the /drive: and /home-drive options from the FreeRDP command line.
When drive redirection is required, share a dedicated directory that contains no sensitive prefix-sibling directories at the same parent level.
Enforce egress firewall rules that block RDP connections to hosts outside a corporate allowlist.

bash

# Example: launch FreeRDP without drive redirection
xfreerdp /v:rdp.example.internal /u:alice \
    /cert:tofu \
    +clipboard

# If drive redirection is required, share an isolated directory
mkdir -p /home/alice/rdp-share-isolated
xfreerdp /v:rdp.example.internal /u:alice \
    /drive:share,/home/alice/rdp-share-isolated \
    /cert:tofu