CVE-2026-109247
Received Received - Intake

Path Traversal in FreeRDP Clipboard Handling

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
FreeRDP before 3.32.0 contains a path traversal vulnerability in convert_filedescriptors_to_file_list() in winpr/libwinpr/clipboard/synthetic_file.c, which concatenates server-supplied cFileName values from FileGroupDescriptorW clipboard data into the published local file:// URI without rejecting '/' or '..' sequences. A malicious RDP server can supply '../' sequences so the user's next clipboard paste copies an arbitrary local file readable by the client user instead of the expected remote file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109247
EUVD
EUVD-2026-97691

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
FreeRDP FreeRDP 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

FreeRDP before version 3.32.0 has a path traversal vulnerability in its clipboard handling. When a user connects to a malicious RDP server, the server can send specially crafted clipboard data containing path traversal sequences like '../'. This tricks the client into creating a local file:// URI that points to an arbitrary file on the user's system instead of the intended remote file. When the user pastes the clipboard content, their system may read the attacker's chosen local file.

Detection Guidance

Check FreeRDP version with 'xfreerdp --version' or 'apt list --installed | grep freerdp'. If version is below 3.32.0, the system is vulnerable. Monitor clipboard operations for unexpected file:// URIs containing '../' sequences.

Impact Analysis

This vulnerability allows an attacker controlling an RDP server to read files on your local system. If you paste clipboard content from a malicious server, your system may access a file you didn't intend to share. The attack requires user interaction (pasting clipboard content) and only works if your FreeRDP version is before 3.32.0. It can be used for both stealing data and tricking you into pasting malicious files.

Mitigation Strategies

Upgrade FreeRDP to version 3.32.0 or later immediately. Disable clipboard sharing in RDP sessions if not required. Avoid pasting clipboard content from untrusted RDP servers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109247. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart