Description

RustDesk versions 1.3.9 through 1.4.9 contain a path traversal vulnerability in the macOS clipboard file-paste code path. The application accepts peer-supplied file descriptor names and joins them to the selected target directory without requiring normalized relative paths. A remote peer in an active clipboard file-paste session can use parent-directory components or absolute paths to write files outside the intended target directory at locations writable by the RustDesk process. Commit 6f1eb16 fixes the issue by validating descriptor names and safely joining paths.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.7",
  "pubDate": "2026-08-26T14:17:12.667Z",
  "pubdate": "2026-08-26T14:17:12.667Z",
  "executiveSummary": "RustDesk versions 1.3.9 through 1.4.9 are affected by a path traversal vulnerability located within the macOS clipboard file-paste mechanism. The vulnerability stems from insufficient validation of peer-supplied file descriptor names during the file transfer process.\nBy manipulating path components—specifically utilizing parent-directory sequences (e.g., ../) or absolute paths—a remote adversary can bypass directory restrictions and write arbitrary files to the host system. The exploitation of this flaw occurs during an active clipboard file-paste session, requiring an established connection between the attacker and the victim.\nSuccessful exploitation allows the remote peer to write files to any location on the host machine that is writable by the RustDesk process, potentially leading to arbitrary code execution, configuration tampering, or data exfiltration. This vulnerability poses a critical risk to users, as it effectively elevates the privileges of a remote peer beyond the intended sandbox constraints of the clipboard transfer utility.\nThe vulnerability is remediated by implementing strict path normalization and descriptor validation, as introduced in commit 6f1eb16.",
  "technicalDetails": "The root cause of this vulnerability is an improper input validation flaw within the file handling logic of the RustDesk macOS client. When a user initiates a clipboard file-paste operation, the application receives a file descriptor name from the remote peer. The application logic proceeds to concatenate this user-supplied identifier directly with the target local destination directory.\nThe application fails to sanitize or normalize these paths prior to concatenation. Because the input is not validated against a allowlist or restricted to a specific directory scope, the application is susceptible to path traversal via directory traversal sequences (such as '../') or by specifying absolute file paths. This allows the process, executing with the privileges of the RustDesk user, to write files to unintended directories.\nThe attack flow proceeds as follows: First, an attacker establishes a remote connection with a victim running a vulnerable version of RustDesk (1.3.9–1.4.9). Second, the attacker initiates a clipboard file-paste operation. Third, the attacker crafts a malicious file descriptor name that incorporates traversal characters or an absolute path (e.g., '../../../../tmp/malicious.sh'). Finally, the RustDesk application resolves the path relative to the root or outside the target directory, resulting in the file being written to the attacker-specified location.\nThis vulnerability is particularly dangerous because it does not require administrative privileges on the target system; the attacker inherits the permission scope of the RustDesk process itself. If the RustDesk process is running with elevated privileges or has write access to sensitive locations, the impact is significantly amplified. The lack of normalization creates a direct path for an authenticated peer to escape the designated transfer sandbox.\nCommit 6f1eb16 addresses this issue by introducing mandatory validation logic that checks the structure of the incoming file descriptor names. By ensuring that all supplied paths are normalized and verified to reside within the intended target directory, the patch effectively mitigates the risk of traversal attacks during remote clipboard operations."
}