CVE-2026-109247

freerdp: freerdp: Information disclosure via clipboard path traversal

Loading…

Severity

Low

Red Hat Product Security

3.1

CVSS 3.1

Review impact separately from score.

Published · October 13, 2026

Updated · October 14, 2026

Description

A flaw was found in FreeRDP's clipboard handling component. A malicious Remote Desktop Protocol (RDP) server can supply crafted file names containing directory traversal sequences in clipboard data. When a user pastes content into a local file manager, the client improperly resolves the path, causing local files accessible to the user to be accessed instead of the expected remote files. This issue can lead to unauthorized information disclosure if the user pastes the files into a shared or server-accessible location.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')