The vulnerability in FreeRDP prior to version 3.29.0 involves improper validation of server-supplied paths used in drive redirection (RDPDR). Specifically, the software fails to correctly enforce the shared-root boundary, enabling a malicious RDP server to specify prefix-sibling paths that escape the intended directory restrictions. This path traversal issue (CWE-22) allows attackers to perform unauthorized file operations such as read, write, delete, and enumeration on directories adjacent to the shared root. The CVSS v3.1 base score is 6.3, indicating a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.

An attacker controlling a malicious RDP server can exploit this vulnerability to access files and directories outside the intended shared root on the client system. This includes the ability to read, modify, delete, and enumerate files in sibling directories, potentially leading to data exposure and manipulation. The vulnerability affects confidentiality, integrity, and availability of client files accessible via drive redirection.

No official patch or fix is currently confirmed for this vulnerability. Users should monitor the vendor's advisory for updates and apply the official fix once available. Until then, avoid connecting to untrusted or potentially malicious RDP servers to mitigate risk. No cloud service remediation applies as this is client-side software.