{"id":"CVE-2022-39347","summary":"Missing path sanitation with `drive` channel in FreeRDP","details":"FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing path canonicalization and base path check for `drive` channel. A malicious server can trick a FreeRDP based client to read files outside the shared directory. This issue has been addressed in version 2.9.0 and all users are advised to upgrade. Users unable to upgrade should not use the `/drive`, `/drives` or `+home-drive` redirection switch.","aliases":["GHSA-c5xq-8v35-pffg"],"modified":"2026-08-12T13:33:14.162092Z","published":"2022-11-16T00:00:00Z","related":["ALSA-2023:2326","ALSA-2023:2851","SUSE-SU-2023:0399-1","SUSE-SU-2023:0400-1"],"database_specific":{"cwe_ids":["CWE-22"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39347.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39347.json"},{"type":"ADVISORY","url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c5xq-8v35-pffg"},{"type":"ADVISORY","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDOTAOJBCZKREZJPT6VZ25GESI5T6RBG/"},{"type":"ADVISORY","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YGQN3OWQNHSMWKOF4D35PF5ASKNLC74B/"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-39347"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/202401-16"},{"type":"FIX","url":"https://github.com/FreeRDP/FreeRDP/commit/027424c2c6c0991cb9c22f9511478229c9b17e5d"},{"type":"ARTICLE","url":"https://lists.debian.org/debian-lts-announce/2023/11/msg00010.html"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/freerdp/freerdp","events":[{"introduced":"0"},{"fixed":"fa8e1b1c765a4466030ac52240f052c0b440a4d1"},{"fixed":"027424c2c6c0991cb9c22f9511478229c9b17e5d"}],"database_specific":{"cpe":"cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"2.9.0"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["2.8.1","2.8.0","2.7.0","2.6.1","2.6.0","2.5.0","2.4.1","2.3.2","2.3.1","2.3.0","2.2.0","2.1.2","2.1.1","2.1.0","2.0.0","2.0.0-rc4","2.0.0-rc3","2.0.0-rc2","2.0.0-rc1","2.0.0-rc0","2.0.0-beta1+android11","2.0.0-beta1+android10","1.2.0-beta1+android9","1.2.0-beta1+android7","1.1.0-beta+2013071101","1.1.0-beta1+ios4","1.1.0-beta1+android5","1.1.0-beta1+android4","1.1.0-beta1+ios3","1.1.0-beta1+ios2","1.1.0-beta1+android3","1.1.0-beta1+android2","1.1.0-beta1+ios1","1.1.0-beta1","1.0.1","1.0.0","1.0-beta5","1.0-beta4","1.0-beta2","1.0-beta1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-39347.json","vanir_signatures_modified":"2026-08-12T13:33:14Z","vanir_signatures":[{"id":"CVE-2022-39347-3508b184","signature_type":"Line","signature_version":"v1","source":"https://github.com/freerdp/freerdp/commit/027424c2c6c0991cb9c22f9511478229c9b17e5d","target":{"file":"channels/drive/client/drive_main.c"},"deprecated":false,"digest":{"line_hashes":["290591328942394821619176785848561268410","335406687288143362762442667856828215649","20519757147941846060567017784870984854","229972281375681814445391784799988295429","140749441333289697312946167814323960243","190308491853018271083008128430940233846","233838662661606121033355431086464318248","145098627091867605178255376497829386340","76448358934214355866670668815517047123","176991272943609779726655330632101995046"],"threshold":0.9}},{"id":"CVE-2022-39347-390224e9","signature_type":"Function","signature_version":"v1","source":"https://github.com/freerdp/freerdp/commit/027424c2c6c0991cb9c22f9511478229c9b17e5d","target":{"file":"channels/drive/client/drive_file.c","function":"drive_file_combine_fullpath"},"deprecated":false,"digest":{"function_hash":"260952216101100896571612303714273406875","length":473}},{"deprecated":false,"digest":{"line_hashes":["248553239335900325584985289247176288716","135878278048545551566787446066942222975","172620551596641331948330102805732093158","295425609185696648157631465253483552010","221383497882808530476471175391678400317","254317494590996612115867831136584923116","238735998323664406757986581235841707939","263527676561790304475541892763209934160","91112401587650353128882219337340322382","176964976740551186718815375593605223925","299013501032045782459172379336665560152","306517712545606911363178016660788672160","25343794043994341743336467643709781280","266027263182689156065952150047698167934","132049146076183447371189191955632865845","213169873153768706863367101394587424803","91551370229648943735730759740791499582","189099272955315653813835860922073462517","197971798508174200408308734764115696061","100118585381496216313445735170734986397","186773629910537752876184955179518357991","155166266405092132195045250486454029525","239700266876474759311878725045063559972","268766385012771439970062345546858218609","175256353515058124457488147637521995026","331948336464000134154078014774151712632","93197270941532769303713781290470510568","311686831208996926794012716428961015846","243975057745125963175279566168304283557","300382968748650816169147881297891167910","319160185026761803757329949586413605099","78190912635033918908994274708933004968","61494029176309532305322085274840059670","266040420684510491325306679388149054519","6567488724521620197671488945777052874","46929630654712137694530974838879745597","259591874064448054096037883104655247739","161391879775698111432148170382011096558","176243534394555782634559055334850965855","317593280284314763805123358625838343045","279279150360429849387881363606545527804","273879949949396719008903306245644600309","121204031919672000931190203736095522178","192491476919648809011070738452622796734","218388636401376795867216074486296129093","113854674659146396263886920465338187594","65035649048143300817322523019449389111","65430323170042994621023208588148545871","23915142942408653610202811291622571446","288764499136229373300548631669629507487","245384090310431392522913793723813156261","59556694233017307990736952932821628496","134557425674643250413495831428070120819","315756958536373758929089354364954650074","177116783596327202560342777165785016662","289430643373693815951420401843210715792","173869059712170358061485805502118274280","19397340730597852473308895637558998115","186430052832808390098851055813847777117","308149034795781231556178808713401390134","332224044163609177248291264037363465730","82686224434858307524972996435364143355","248382609252166450697119703981488141970","241025741252792625174358725144482963412","257809229915169453538946618425746688519","71931066835543294576121017612616331016","40705453148024616383076843360999041841","226247864100701000061367158484563948438","162699948461877850696868147397836642617","147551768246211167971635961816345235588","118946247848326709538424218563247718363","184051266245511055840359691878850903589","314587923817559469016796073220590359113","181231047586802876657803920976726764079","72774197824611249642252770787715273270","154471152255016975646052331054914490077","152259281539908125707006612375846709949","220715322427924304083543280978416588444","307294325166581388755195954986760290709","128258109548279524457942213068370053492","28196237252488805870035169806523481544","221701928761195426375258303037461556081","13894025492365548226743864539252817196","315608466339390195743846133040187849480","302661308763062461000336958030943294749","60887097567097397691673400878172617221","41624692126751203286259804952514945410","213887536283202875159733887323741877741","234036708142946729045448540181453443123","231141018540379579968556768871493390042","98197901034005382906628345939175522453","105069653898801318212634578137125337791","293966427902171113129649186575483337779","263948757973881768749334840785327655987","321555479646930445071305262215274213968","137349947884731218518483985036383940491","27746345551637029114359567552861759204"],"threshold":0.9},"id":"CVE-2022-39347-448a8724","signature_type":"Line","signature_version":"v1","source":"https://github.com/freerdp/freerdp/commit/027424c2c6c0991cb9c22f9511478229c9b17e5d","target":{"file":"channels/drive/client/drive_file.c"}},{"signature_version":"v1","source":"https://github.com/freerdp/freerdp/commit/027424c2c6c0991cb9c22f9511478229c9b17e5d","target":{"file":"channels/drive/client/drive_file.h"},"deprecated":false,"digest":{"line_hashes":["72948886230247326096666785655918579858","29333083308896062814581375091197699878","30909489476707713747924496511064340021","265889586962900380121165192111511246271","141173924152054176952941177348977304297","35144359828024183922527558511163564686","165791126707946461535592763500382707748","238962438083969342402474376136096362375"],"threshold":0.9},"id":"CVE-2022-39347-45201795","signature_type":"Line"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/freerdp/freerdp/commit/027424c2c6c0991cb9c22f9511478229c9b17e5d","target":{"file":"channels/drive/client/drive_file.c","function":"drive_file_set_information"},"deprecated":false,"digest":{"function_hash":"240481646969107594940048899026392203014","length":3685},"id":"CVE-2022-39347-b313b2ca"},{"digest":{"function_hash":"22588013693904811326232017491640203341","length":1194},"id":"CVE-2022-39347-bab26d34","signature_type":"Function","signature_version":"v1","source":"https://github.com/freerdp/freerdp/commit/027424c2c6c0991cb9c22f9511478229c9b17e5d","target":{"file":"channels/drive/client/drive_file.c","function":"drive_file_remove_dir"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/freerdp/freerdp/commit/027424c2c6c0991cb9c22f9511478229c9b17e5d","target":{"file":"channels/drive/client/drive_main.c","function":"drive_process_irp_create"},"deprecated":false,"digest":{"function_hash":"312948699714045788384632950966874520297","length":1529},"id":"CVE-2022-39347-c0726788","signature_type":"Function"},{"target":{"file":"channels/drive/client/drive_file.c","function":"drive_file_fix_path"},"deprecated":false,"digest":{"function_hash":"145655026188127974666537535230233011320","length":437},"id":"CVE-2022-39347-e2e1eaca","signature_type":"Function","signature_version":"v1","source":"https://github.com/freerdp/freerdp/commit/027424c2c6c0991cb9c22f9511478229c9b17e5d"},{"deprecated":false,"digest":{"length":854,"function_hash":"173094841742670436169063300056138337321"},"id":"CVE-2022-39347-eff9c255","signature_type":"Function","signature_version":"v1","source":"https://github.com/freerdp/freerdp/commit/027424c2c6c0991cb9c22f9511478229c9b17e5d","target":{"function":"drive_process_irp_query_directory","file":"channels/drive/client/drive_main.c"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N"}]}