CVE-2026-33145 Details
Description
xrdp is an open source RDP server. Versions through 0.10.5 allow an authenticated remote user to execute arbitrary commands on the server due to unsafe handling of the AlternateShell parameter in xrdp-sesman. When the AllowAlternateShell setting is enabled (which is the default when not explicitly configured), xrdp accepts a client-supplied AlternateShell value and executes it via /bin/sh -c during session initialization. This results in shell-interpreted execution of unsanitized, user-controlled input. This behavior effectively provides a scriptable remote command execution primitive over RDP within the security context of the authenticated user, occurring prior to normal window manager startup. This can bypass expected session initialization flows and operational assumptions that restrict execution to interactive desktop environments. This issue has been fixed in version 0.10.6.
A command execution vulnerability has been identified in xrdp, an open-source RDP server, in versions prior to 0.10.6. The issue arises from unsafe handling of the AlternateShell parameter in xrdp-sesman, which allows an authenticated remote user to execute arbitrary commands on the server. When the AllowAlternateShell setting is enabled by default, xrdp executes client-supplied AlternateShell values through /bin/sh -c during session initialization. This behavior enables the execution of unsanitized, user-controlled input as commands, creating a remote command execution vulnerability over RDP within the authenticated user's security context, and bypassing normal session initialization processes that limit execution to interactive desktop environments.
Users can upgrade to xrdp version 0.10.6 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6 | [email protected] | PatchRelease Notes |
| https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-rmvv-7633-fg7h | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| neutrinolabs xrdp | < 0.10.6 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 27, 2026 | Initial Analysis | [email protected] |
| Apr 17, 2026 | New CVE Received | [email protected] |