| Package | Affected versions | Patched versions |
|---|---|---|
| freerdp | < 3.32.0 | 3.32.0 |
FreeRDP before 3.32.0 contains a path traversal vulnerability in convert_filedescriptors_to_file_list() in winpr/libwinpr/clipboard/synthetic_file.c, which concatenates server-supplied cFileName values from FileGroupDescriptorW clipboard data into the published local file:// URI without rejecting '/' or '..' sequences. A malicious RDP server can supply '../' sequences so the user's next clipboard paste copies an arbitrary local file readable by the client user instead of the expected remote file.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free