CVE-2026-33145

{
  "id": "CVE-2026-33145",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-17T21:16:32.610",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "xrdp is an open source RDP server. Versions through 0.10.5 allow an authenticated remote user to execute arbitrary commands on the server due to unsafe handling of the AlternateShell parameter in xrdp-sesman. When the AllowAlternateShell setting is enabled (which is the default when not explicitly configured), xrdp accepts a client-supplied AlternateShell value and executes it via /bin/sh -c during session initialization. This results in shell-interpreted execution of unsanitized, user-controlled input. This behavior effectively provides a scriptable remote command execution primitive over RDP within the security context of the authenticated user, occurring prior to normal window manager startup. This can bypass expected session initialization flows and operational assumptions that restrict execution to interactive desktop environments. This issue has been fixed in version 0.10.6."
    },
    {
      "lang": "es",
      "value": "xrdp es un servidor RDP de código abierto. Las versiones hasta la 0.10.5 permiten a un usuario remoto autenticado ejecutar comandos arbitrarios en el servidor debido a un manejo inseguro del parámetro AlternateShell en xrdp-sesman. Cuando la configuración AllowAlternateShell está habilitada (lo cual es el valor predeterminado si no se configura explícitamente), xrdp acepta un valor AlternateShell proporcionado por el cliente y lo ejecuta a través de /bin/sh -c durante la inicialización de la sesión. Esto resulta en la ejecución interpretada por el shell de entrada no saneada y controlada por el usuario. Este comportamiento proporciona efectivamente una primitiva de ejecución remota de comandos programable sobre RDP dentro del contexto de seguridad del usuario autenticado, ocurriendo antes del inicio normal del gestor de ventanas. Esto puede eludir los flujos esperados de inicialización de sesión y las suposiciones operativas que restringen la ejecución a entornos de escritorio interactivos. Este problema ha sido corregido en la versión 0.10.6."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "neutrinolabs",
          "product": "xrdp",
          "versions": [
            {
              "version": "< 0.10.6",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-22T03:55:37.345853Z",
          "id": "CVE-2026-33145",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:neutrinolabs:xrdp:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "0.10.6",
              "matchCriteriaId": "BC4D3050-83C5-4368-B1D3-534B28E0917A"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6",
      "source": "[email protected]",
      "tags": [
        "Patch",
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-rmvv-7633-fg7h",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}