CVE catalog

CVE-2026-33145

Severity: Medium · CVSS 6.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Published: Apr 17, 2026, 8:14:14 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.36% · Oct 25, 2026

xrdp is an open source RDP server. Versions through 0.10.5 allow an authenticated remote user to execute arbitrary commands on the server due to unsafe handling of the AlternateShell parameter in xrdp-sesman. When the AllowAlternateShell setting is enabled (which is the default when not explicitly configured), xrdp accepts a client-supplied AlternateShell value and executes it via /bin/sh -c during session initialization. This results in shell-interpreted execution of unsanitized, user-controlled input. This behavior effectively provides a scriptable remote command execution primitive over RDP within the security context of the authenticated user, occurring prior to normal window manager startup. This can bypass expected session initialization flows and operational assumptions that restrict execution to interactive desktop environments. This issue has been fixed in version 0.10.6.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	xrdp	sid	`0.10.6.1-3`	fixed
Debian	xrdp	forky	`0.10.6.1-3`	fixed
Debian	xrdp	trixie	`0.10.1-3.1+deb13u2`	fixed
Debian	xrdp	trixie-security	`0.10.1-3.1+deb13u2`	fixed
Debian	xrdp	bookworm	`0.9.21.1-1+deb12u2`	vulnerable
Debian	xrdp	bookworm-security	`0.9.21.1-1+deb12u3`	vulnerable
Cpe	xrdp	Not reported	Not reported	vulnerable
Cpe	xrdp	Not reported	`0.10.6`	fixed
Cpe	xrdp	Not reported	`0.10.6`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	xrdp	source	sid	`0.10.6-1`	not yet assigned	Not reported	[1134339]
Debian	xrdp	source	forky	`0.10.6-1`	not yet assigned	Not reported	[1134339]
Debian	xrdp	source	trixie	`0.10.1-3.1+deb13u2`	not yet assigned	Not reported	[1134339]
Debian	xrdp	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1134339]
Cpe	xrdp	cpe	Not reported	`0.10.6`	Not reported	Not reported	Not reported
Cpe	xrdp	cpe	Not reported	`0.10.6`	Not reported	NVD-CVE-2026-33145	Not reported

[Debian bug #1134339]

Notes

[bookworm] xrdp: Intrusive to backport

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[xrdp]Affected
Details (6)
- 0.9.21.1-1+deb12u2 · amd64 · bookworm
  Affected
  nvd · xrdp · debian · bookworm; nvd · xrdp · debian · 12
- 0.9.21.1-1+deb12u2 · arm64 · bookworm
  Affected
  nvd · xrdp · debian · bookworm; nvd · xrdp · debian · 12
- 0.9.24-5~bpo12+1 · amd64 · bookworm-backports
  Affected
  nvd · xrdp · debian · bookworm; nvd · xrdp · debian · 12
- 0.9.24-5~bpo12+1 · arm64 · bookworm-backports
  Affected
  nvd · xrdp · debian · bookworm; nvd · xrdp · debian · 12
- 0.9.21.1-1+deb12u3 · amd64 · bookworm-security
  Affected
  nvd · xrdp · debian · bookworm; nvd · xrdp · debian · 12
- 0.9.21.1-1+deb12u3 · arm64 · bookworm-security
  Affected
  nvd · xrdp · debian · bookworm; nvd · xrdp · debian · 12

[Debian 13 (Trixie)]

[xrdp]Affected
Details (5)
- 0.10.1-3.1+deb13u1 · amd64 · trixie
  Affected · Fixed: 0.10.1-3.1+deb13u2
  nvd · xrdp · debian · 13
- 0.10.1-3.1+deb13u1 · arm64 · trixie
  Affected · Fixed: 0.10.1-3.1+deb13u2
  nvd · xrdp · debian · 13
- 0.10.1-3.1+deb13u1 · amd64 · trixie-security · Historical version
  Affected · Fixed: 0.10.1-3.1+deb13u2
  nvd · xrdp · debian · 13
- 0.10.1-3.1+deb13u2 · amd64 · trixie-security
  Fixed · Fixed: 0.10.1-3.1+deb13u2
  nvd · xrdp · debian · 13
- 0.10.1-3.1+deb13u2 · arm64 · trixie-security
  Fixed · Fixed: 0.10.1-3.1+deb13u2
  nvd · xrdp · debian · 13

Observed: Oct 27, 2026, 7:59:03 AM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]