The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - FreeRDP is a free implementation of the Remote Desktop Protocol. Versions prior to 3.25.0 have an off-by-     one in the path traversal filter in `channels/drive/client/drive_file.c`. The `contains_dotdot()` function     catches `../` and `..\` mid-path but misses `..` when it's the last component with no trailing separator.
    A rogue RDP server can read, list, or write files one directory above the client's shared folder through     RDPDR requests. This requires the victim to connect with drive redirection enabled. Version 3.25.0 patches     the issue. (CVE-2026-40254)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-40254

medium Nessus Plugin ID 310292

Version 1.7