The FreeRDP implementation contains an off‑by‑one error in its path‑traversal filter. The function that blocks directory traversal sequences does not detect a trailing '..' when it appears as the last component of a path. An attacker who controls the remote RDP server can send specially crafted drive‑redirection requests to read, list, or write files located one directory above the client’s shared folder. This flaw is a CWE‑193: Off‑by‑One Error. The vulnerability does not enable arbitrary code execution but grants elevated file‑system access to the client during an RDP session.

All FreeRDP releases prior to version 3.25.0 are affected. The issue exists in the drive channel client code located in channels/drive/client/drive_file.c. Users running FreeRDP 3.24.x or earlier with drive redirection enabled should update to 3.25.0, the patched version.

The CVSS score of 4.2 indicates a medium impact. The EPSS score is reported as <1%, suggesting a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the victim to initiate an RDP connection with drive redirection enabled, and a malicious server can then exploit the path‑traversal flaw to access the client’s files one level above the shared directory. The attack vector is remote, dependent on a trusted RDP session, and does not provide direct remote code execution.