PT-2026-110664

CVE-2026-109247

Published

2026-10-12

Updated

2026-10-12

Description by

CVSS 3.1

3.1

Low

MetricsAV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.32.0

Description An issue exists in the convert filedescriptors to file list() function within winpr/libwinpr/clipboard/synthetic file.c. The software fails to reject / or .. sequences when concatenating server-supplied cFileName values from FileGroupDescriptorW clipboard data into the local file:// URI. This allows a malicious RDP server to use path traversal sequences to trick the client into copying an arbitrary local file readable by the user during the next clipboard paste operation.

Recommendations Update to version 3.32.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Davidkorczynski

Vendors

Affected products

Weakness enumeration

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')

Related identifiers