CVE-2026-73102

CVE-2026-73102 is a path traversal vulnerability found in RustDesk versions 1.3.9 through 1.4.9, specifically impacting the macOS clipboard file-paste functionality. The vulnerability arises because the application accepts file descriptor names provided by a peer and incorporates them into the target directory without adequately normalizing relative paths. This flaw allows a remote peer engaged in an active clipboard file-paste session to utilize parent-directory components or absolute paths. This enables them to write files to locations outside the designated target directory, provided those locations are writable by the RustDesk process. The issue has been addressed by implementing validation for descriptor names and ensuring safe path joining.