CVE-2026-73102
Received Received - Intake

Path Traversal in RustDesk macOS Clipboard Paste

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: VulnCheck

Description
RustDesk versions 1.3.9 through 1.4.9 contain a path traversal vulnerability in the macOS clipboard file-paste code path. The application accepts peer-supplied file descriptor names and joins them to the selected target directory without requiring normalized relative paths. A remote peer in an active clipboard file-paste session can use parent-directory components or absolute paths to write files outside the intended target directory at locations writable by the RustDesk process. Commit 6f1eb16 fixes the issue by validating descriptor names and safely joining paths.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-26
Last Modified
2026-08-26
Generated
2026-08-26
AI Q&A
2026-08-26
EPSS Evaluated
N/A
NVD
CVE-2026-73102
EUVD
EUVD-2026-66421

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
rustdesk rustdesk From 1.3.9 (inc) to 1.4.9 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

RustDesk versions 1.3.9 through 1.4.9 have a path traversal vulnerability in the macOS clipboard file-paste feature. The app accepts file descriptor names from peers and joins them to a target directory without proper path normalization. This allows a remote peer in an active clipboard session to use parent-directory components or absolute paths to write files outside the intended directory if the RustDesk process has write permissions.

Detection Guidance

Check RustDesk versions 1.3.9 through 1.4.9 on macOS systems. Monitor clipboard file-paste sessions for unexpected file writes outside intended directories. Review logs for path traversal attempts like '../' or absolute paths in file descriptors.

Impact Analysis

An attacker could exploit this to write malicious files to arbitrary locations on your system where RustDesk has write access. This could lead to code execution, data corruption, or installation of malware if the attacker crafts a malicious file path.

Mitigation Strategies

Upgrade RustDesk to a version beyond 1.4.9 where the fix (commit 6f1eb16) is applied. Disable clipboard file-paste functionality if not required. Restrict write permissions for the RustDesk process to limit potential file writes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73102. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart