CVE-2026-73102: RustDesk Path Traversal Vulnerability

CVE-2026-73102 Overview

CVE-2026-73102 is a path traversal vulnerability [CWE-22] in RustDesk versions 1.3.9 through 1.4.9. The flaw resides in the macOS clipboard file-paste code path. RustDesk accepts peer-supplied file descriptor names and joins them to the selected target directory without enforcing normalized relative paths. A remote peer in an active clipboard file-paste session can inject parent-directory components or absolute paths to write files outside the intended target directory. The write occurs at any location reachable by the RustDesk process's file permissions.

Critical Impact
A remote peer with an active clipboard file-paste session can write arbitrary files outside the selected target directory on macOS hosts running RustDesk, enabling integrity compromise of user or application files.

Affected Products

RustDesk 1.3.9 on macOS
RustDesk 1.4.x through 1.4.9 on macOS
Any macOS deployment using RustDesk clipboard file-paste sessions

Discovery Timeline

2026-08-26 - CVE-2026-73102 published to NVD
2026-08-26 - Last updated in NVD database
Commit 6f1eb16 merged via GitHub Pull Request #15693 fixes the issue by validating descriptor names and safely joining paths

Technical Details for CVE-2026-73102

Vulnerability Analysis

RustDesk implements clipboard file-paste over its remote session channel. When a peer copies files, the sender transmits a file descriptor list containing names and metadata. The receiver joins those names to the user-selected destination directory to materialize the pasted files. On macOS, RustDesk does not require the descriptor names to be normalized relative paths. Names containing .. segments or absolute path prefixes bypass the intended directory boundary. The resulting write operates with the privileges of the RustDesk process.

Because the operation modifies files rather than exfiltrating them, exploitation impacts integrity. Attackers can overwrite configuration files, drop payloads into startup locations, or replace files consumed by other applications.

Root Cause

The clipboard file-list handler concatenates untrusted descriptor names with the target directory without canonicalizing or validating the joined path against the intended base. The absence of a check that the resolved path remains inside the destination root allows traversal sequences to escape the directory scope.

Attack Vector

Exploitation requires an established RustDesk session in which the victim initiates or accepts a clipboard file-paste operation with the attacker peer. The attacker crafts a FILEDESCRIPTORW-style entry whose cFileName field contains traversal components or an absolute path. When the victim completes the paste, the receiver writes the file outside the target directory. User interaction is required to trigger the paste.

rust

// Security patch in libs/clipboard/src/platform/unix/mod.rs
// fix(clipboard): validate files (#15693)

/// block size for fuse, align to our asynchronic request size over FileContentsRequest.
pub(crate) const BLOCK_SIZE: u32 = 4 * 1024 * 1024;

+/// `FILEDESCRIPTORW::cFileName` capacity, including the trailing NUL code unit.
+pub(super) const FILE_NAME_CODE_UNITS: usize = 260;
+pub(super) const FILE_NAME_FIELD_SIZE: usize = FILE_NAME_CODE_UNITS * std::mem::size_of::<u16>();
+
// begin of epoch used by microsoft
// 1601-01-01 00:00:00 + LDAP_EPOCH_DELTA*(100 ns) = 1970-01-01 00:00:00
const LDAP_EPOCH_DELTA: u64 = 116444772610000000;

Source: GitHub Commit 6f1eb16

The patch introduces bounded name-field constants and, in serv_files.rs, changes build_file_list_pdu to return Result<(), CliprdrError> so descriptor serialization can fail closed when validation rejects a name.

Detection Methods for CVE-2026-73102

Indicators of Compromise

Files created by the RustDesk process outside user-selected destination directories on macOS hosts
File descriptor payloads observed in RustDesk sessions containing .. sequences or leading / in cFileName
Unexpected writes to ~/Library/LaunchAgents, ~/.zshrc, or other autorun locations coinciding with an active RustDesk session

Detection Strategies

Monitor file-write telemetry attributed to the RustDesk process and alert when the resolved path escapes the user's active paste directory
Correlate RustDesk session activity with newly created files in sensitive macOS locations such as launch agent directories and shell rc files
Inspect RustDesk versions across the fleet and flag any host running 1.3.9 through 1.4.9

Monitoring Recommendations

Enable macOS Endpoint Security file-event auditing for the RustDesk binary and forward events to a centralized log store
Track parent-child process activity from RustDesk to identify secondary execution of files it wrote
Alert on RustDesk clipboard file-paste sessions initiated with unknown or unverified peer IDs

How to Mitigate CVE-2026-73102

Immediate Actions Required

Upgrade RustDesk on macOS to a build that includes commit 6f1eb16 from Pull Request #15693
Restrict RustDesk usage to trusted peers and require session confirmation before accepting clipboard file-paste operations
Audit macOS hosts for RustDesk versions between 1.3.9 and 1.4.9 and prioritize their remediation

Patch Information

The fix is delivered in commit 6f1eb164d616e0e2bfbcf8c6b7c8083b09d7ed06. It validates FILEDESCRIPTORW names, enforces bounded name-field sizes, and safely joins descriptor names to the target directory so that traversal sequences and absolute paths are rejected before any file is written. See the VulnCheck advisory for coordinated disclosure details.

Workarounds

Disable clipboard file transfer in RustDesk client settings until upgrading is possible
Run RustDesk under a least-privileged macOS user account with no write access to sensitive directories
Terminate incoming sessions from unknown peers before any clipboard paste is attempted

bash

# Verify installed RustDesk version on macOS and remove vulnerable builds
/Applications/RustDesk.app/Contents/MacOS/RustDesk --version

# Remove a vulnerable installation prior to upgrading
sudo rm -rf /Applications/RustDesk.app

# Install the patched release from the official RustDesk distribution channel,
# then confirm the build includes commit 6f1eb16