Bug 2461368 (CVE-2026-40254) - CVE-2026-40254 FreeRDP: FreeRDP: Information disclosure and arbitrary file modification via path traversal
Summary: CVE-2026-40254 FreeRDP: FreeRDP: Information disclosure and arbitrary file mo...
Keywords:
Status: NEW
Alias: CVE-2026-40254
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-04-24 03:01 UTC by OSIDB Bzimport
Modified: 2026-04-25 11:40 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-04-24 03:01:37 UTC 
FreeRDP is a free implementation of the Remote Desktop Protocol. Versions prior to 3.25.0 have an off-by-one in the path traversal filter in `channels/drive/client/drive_file.c`. The `contains_dotdot()` function catches `../` and `..\` mid-path but misses `..` when it's the last component with no trailing separator. A rogue RDP server can read, list, or write files one directory above the client's shared folder through RDPDR requests. This requires the victim to connect with drive redirection enabled. Version 3.25.0 patches the issue.
Note You need to log in before you can comment on or make changes to this bug.