PT-2026-67275

CVE-2026-67295

Published

2026-07-15

Updated

2026-10-22

Description by

CVSS 2.0

7.5

High

MetricsAV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.29.0

Description Insufficient validation of server-supplied RDPDR paths during drive redirection allows a malicious RDP server to access prefix-sibling paths outside the configured shared root. By sending non-rooted paths that bypass the shared-root boundary check, an attacker can read, write, delete, and enumerate files in sibling directories.

Recommendations Update to version 3.29.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

1121984919

Vendors

Affected products

Weakness enumeration

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')

Related identifiers