CVE-2026-67295 FreeRDP CVE debrief

Who should care

Users of FreeRDP versions before 3.29.0 should update to mitigate path traversal vulnerabilities via drive redirection. Affected operators, platforms, and security teams should review official advisories and take necessary actions to protect their systems.

Technical summary

FreeRDP before 3.29.0 fails to properly validate server-supplied RDPDR paths in drive redirection, allowing attackers to access prefix-sibling paths outside the configured shared root. This vulnerability can be exploited by a malicious RDP server to read, write, delete, and enumerate files in sibling directories by sending non-rooted paths that bypass the shared-root boundary check. The vulnerability affects FreeRDP versions before 3.29.0 and can be mitigated by updating to version 3.29.0 or later. Affected product deployments should be reviewed for exposure, and compensating controls should be implemented for exposed systems while remediation is scheduled and verified.

Defensive priority

Medium-priority defensive actions are required to address path traversal vulnerabilities in FreeRDP before 3.29.0.

Recommended defensive actions

• Verify and update FreeRDP to version 3.29.0 or later
• Restrict access to RDP services
• Monitor for suspicious RDP activity
• Implement additional security controls for drive redirection
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

FreeRDP before 3.29.0 fails to properly validate server-supplied RDPDR paths in drive redirection, allowing attackers to access prefix-sibling paths outside the configured shared root. Evidence is limited; verify FreeRDP versions before 3.29.0 for path traversal vulnerability via drive redirection. Additional verification tasks include reviewing official advisories, checking for affected product deployments, and monitoring for suspicious RDP activity.

Official resources