CVE-2026-67295

FreeRDP 3.29.0 addresses a drive redirection vulnerability (CVE-2026-67295) that fundamentally differs from classic path traversal. The RDPDR channel implements a shared-root boundary check to isolate client filesystem access, but this check never fires against server-supplied paths that are non-rooted relative to the configured share. Rather than escaping via '..' traversal, these paths bypass validation entirely because the boundary enforcement assumes root-anchored paths from the start — a validation-order error where the check only applies to paths that never arrive in that form. The security implication is significant. This isn't a bounded file-read vulnerability; it's access control model corruption. A malicious server gains read, write, delete, and enumerate capabilities across all sibling directories within the shared root — not sequential escalation, but immediate filesystem-level access. The blast radius exceeds what CVSS 6.3 captures. The vulnerability reflects a deeper pattern: developers coded to match expected server behavior rather than adversarial input. RDP's enterprise origins created an implicit trust model where 'you wouldn't connect to a malicious server' — a topology assumption now breaking down with BYOD, contractor access, and managed service provider scenarios. Prioritized actions: Verify FreeRDP versions older than 3.29.0 are not in use; audit other FreeRDP channels (clipboard, device state, printer redirection) for similar validation-order assumptions where server-supplied parameters are implicitly trusted; recognize that IT infrastructure controlling server selection is a deployment-specific mitigator, not a universal one.

Reviewed through automated stages and approved by a human before publication.