CVE-2026-33145

MEDIUM EPSS 27.5%
Published Apr 17, 20262mo ago · Modified Jun 17, 20261w ago
6.3 CVSS 3.1
Medium
Find Similar
Published Apr 17, 2026 2mo ago
Last Modified Jun 17, 2026 1w ago

Description

xrdp is an open source RDP server. Versions through 0.10.5 allow an authenticated remote user to execute arbitrary commands on the server due to unsafe handling of the AlternateShell parameter in xrdp-sesman. When the AllowAlternateShell setting is enabled (which is the default when not explicitly configured), xrdp accepts a client-supplied AlternateShell value and executes it via /bin/sh -c during session initialization. This results in shell-interpreted execution of unsanitized, user-controlled input. This behavior effectively provides a scriptable remote command execution primitive over RDP within the security context of the authenticated user, occurring prior to normal window manager startup. This can bypass expected session initialization flows and operational assumptions that restrict execution to interactive desktop environments. This issue has been fixed in version 0.10.6.

CVSS Details

Base Score
6.3
Exploitability
2.8
Impact
3.4
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality Low
Integrity Low
Availability Low

Threat Intelligence

EPSS Exploit Probability
27.5% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-78 OS Command Injection Injection

Affected Products 1

VendorProductVersionRange
neutrinolabsxrdp* <0.10.6

References 2

  • github.com https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6
    PatchRelease Notes
  • github.com https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-rmvv-7633-fg7h
    Vendor Advisory

Remediation

  • github.com https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6
    PatchRelease Notes