CVE-2026-40254 FreeRDP: contains_dotdot() off-by-one allows drive channel path traversal via terminal ..

What is CVE-2026-40254?

CVE-2026-40254 is a medium-severity path traversal vulnerability in Freerdp Freerdp, published on 24 Apr 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

FreeRDP is a free implementation of the Remote Desktop Protocol. Versions prior to 3.25.0 have an off-by-one in the path traversal filter in `channels/drive/client/drive_file.c`. The `contains_dotdot()` function catches `../` and `..\` mid-path but misses `..` when it's the last component with no trailing separator. A rogue RDP server can read, list, or write files one directory above the client's shared folder through RDPDR requests. This requires the victim to connect with drive redirection enabled. Version 3.25.0 patches the issue.

Weakness: CWE-193

Which versions are affected by CVE-2026-40254?

It affects 1 product.

Products include Freerdp Freerdp.

How do I fix CVE-2026-40254?

Upgrade to a fixed version.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-40254 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-40254 exists.

Other vulnerabilities in Freerdp Freerdp

• CVE-2021-37594 Other in n/a Critical 9.8
• CVE-2021-37595 Other in n/a Critical 9.8
• CVE-2026-67305 FreeRDP Windows Client before 3.29.0 Heap Buffer Overflow via Cliprdr Critical 9.4
• CVE-2026-66402 FreeRDP before 3.29.0 TLS Certificate Identity Validation Bypass Critical 9.3
• CVE-2026-67289 FreeRDP before 3.29.0 HTTP Proxy Request Injection via Redirection Critical 9.3

All Freerdp Freerdp vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-40254, GHSA-3xpj-m4hx-8vmx, UBUNTU-CVE-2026-40254, openSUSE-SU-2026:10832-1.