| Package | Affected versions | Patched versions |
|---|---|---|
| freerdp | < 3.28.0 | 3.28.0 |
FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attackers can craft malicious RDP files with /rdp2tcp, /cert:ignore, or /drive options to execute arbitrary commands, bypass certificate validation, or expose local filesystems without user interaction.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free