CVE-2026-33145: xrdp: Authenticated RCE via unsanitized AlternateShell execution in xrdp-sesman

Severity: medium (CVSS 6.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-17 · updated 2026-10-26
Weakness: CWE-78

Description

xrdp is an open source RDP server. Versions through 0.10.5 allow an authenticated remote user to execute arbitrary commands on the server due to unsafe handling of the AlternateShell parameter in xrdp-sesman. When the AllowAlternateShell setting is enabled (which is the default when not explicitly configured), xrdp accepts a client-supplied AlternateShell value and executes it via /bin/sh -c during session initialization. This results in shell-interpreted execution of unsanitized, user-controlled input. This behavior effectively provides a scriptable remote command execution primitive over RDP within the security context of the authenticated user, occurring prior to normal window manager startup. This can bypass expected session initialization flows and operational assumptions that restrict execution to interactive desktop environments. This issue has been fixed in version 0.10.6.

Affected products

neutrinolabs xrdp: before 0.10.6 — fixed in 0.10.6

How to fix

Upgrade to a fixed version: neutrinolabs xrdp 0.10.6. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-33145 or the next vulnerability affects your stack