FreeRDP before version 3.32.0 has a path traversal flaw in the clipboard handling code, where server‑supplied cFileName values are concatenated into a local file URI without sanitizing slashes or dot‑dot sequences. A malicious RDP server can embed '../' in the FileGroupDescriptorW clipboard data, causing the client’s clipboard paste to read an arbitrary local file instead of the intended remote file. This weakness (CWE‑22) compromises the confidentiality of files readable by the client user.

The affected product is FreeRDP (FreeRDP) for all releases earlier than 3.32.0.

The CVSS score of 2.1 indicates a low severity issue. EPSS is not available and the vulnerability is not listed in CISA KEV. The attack vector requires control of the RDP server to supply malicious clipboard data, so exploitation is limited to environments where the client connects to a potentially untrusted RDP session. While the impact is confined to local file disclosure, the lack of built‑in clipboard sanitization makes the risk moderate but worthwhile to address.