FreeRDP before 3.32.0 contains a path traversal vulnerability in convert_filedescriptors_to_file_list() in… (CVE-2026-109247)

The vulnerability in FreeRDP before version 3.32.0 exists in the convert_filedescriptors_to_file_list() function located in winpr/libwinpr/clipboard/synthetic_file.c. The function improperly handles FileGroupDescriptorW clipboard data by concatenating server-supplied cFileName values into local file:// URIs without rejecting path traversal sequences such as '/' or '../'. This allows a malicious RDP server to supply '../' sequences that cause the client to copy arbitrary local files during clipboard paste operations instead of the expected remote files.

A malicious RDP server can exploit this vulnerability to cause the client to read arbitrary local files when pasting clipboard data. This results in limited confidentiality impact as local files readable by the client user may be exposed. There is no impact on integrity or availability. The CVSS score is 3.1 (low severity), reflecting the requirement for user interaction and high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious when connecting to untrusted RDP servers and avoid clipboard operations that involve file transfers from unknown sources.