Read the docs
TI-2026-51298 Aliases CVE-2026-73102GHSA-w982-6rqp-v5xg

RustDesk Path Traversal via macOS Clipboard File-Paste

Priority LOW 31CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

RustDesk versions 1.3.9 through 1.4.9 contain a path traversal vulnerability in the macOS clipboard file-paste code path. The application accepts peer-supplied file descriptor names and joins them to the selected target directory without requiring normalized relative paths. A remote peer in an active clipboard file-paste session can use parent-directory components or absolute paths to write files outside the intended target directory at locations writable by the RustDesk process. Commit 6f1eb16 fixes the issue by validating descriptor names and safely joining paths.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00391 33rd percentileScored 2026-11-07
Fix Fixed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
rustdesk-clientrustdesk1.3.9 – 1.4.9—Patch availableCNA
  • rustdesk Vendorrustdesk-client Affected 1.3.9 – 1.4.9 Fixed in — Patch available CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-73102
  2. 2026-10-03 Alias added: GHSA-w982-6rqp-v5xg

References

Patch 2

  • TI-2024-16591 A default installation of RustDesk 1.2.3 on Windows places a WDKTestCert certificate… CVSS 3.1CRITICAL 9.8
  • TI-2026-23626 RustDesk HTTP Client Silently Accepts Invalid TLS Certificates After Handshake Failure CVSS 4.0HIGH 8.7
  • TI-2026-23624 RustDesk Client Blindly Merges Unauthenticated Strategy Payloads, Bypassing Local Security Settings CVSS 4.0HIGH 8.3
  • TI-2026-23621 RustDesk Encrypts Local Passwords with World-Readable Machine ID and Fixed Zero Nonce (XSalsa20-Poly1305) CVSS 4.0HIGH 8.2
  • TI-2026-03102 RustDesk Server Generates Config Strings Using Reversible Encoding (Base64 + Reverse) Instead of Encryption CVSS 4.0HIGH 8.7
  • TI-2026-23629 RustDesk Client Accepts Unauthenticated stop-service Command via Strategy Payload CVSS 4.0HIGH 8.2
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences