CVE-2026-18751: Citrix Workspace App Path Traversal Flaw

CVE-2026-18751 Overview

Citrix disclosed CVE-2026-18751, an external control of file name or path vulnerability affecting Citrix Workspace App for macOS version 2607. The flaw is categorized under [CWE-73] and stems from insufficient validation of file paths supplied to the application. A local authenticated user with user interaction can influence file path operations to write or modify files outside the intended scope. Successful exploitation impacts integrity and availability on the affected macOS host without leaking confidential data. Citrix documented the issue in support article CTX696911.

Critical Impact
A local attacker with low privileges can manipulate file names or paths to alter or destroy files, compromising integrity and availability on macOS endpoints running Citrix Workspace App 2607.

Affected Products

Citrix Workspace App for macOS
Affected version: 2607
Platform: Apple macOS

Discovery Timeline

2026-08-18 - CVE-2026-18751 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-18751

Vulnerability Analysis

The vulnerability is a path traversal class weakness classified as [CWE-73] External Control of File Name or Path. Citrix Workspace App for macOS accepts input that influences a file name or path used in a privileged file operation. Because the application does not properly constrain or canonicalize this input, an attacker can direct the operation to a file outside the intended directory. The attack requires local access and low privileges, and it needs user interaction to trigger the vulnerable code path. Impact centers on integrity and availability, allowing the attacker to overwrite, replace, or remove files accessible to the Workspace App process.

Root Cause

The root cause is improper validation of externally supplied file path input. The application trusts a path fragment or file identifier and passes it to a filesystem API without enforcing a base directory, symlink resolution, or allowlist. This allows relative traversal sequences or absolute path substitution to redirect the operation.

Attack Vector

Exploitation requires a local, authenticated user on the macOS host and interaction with a crafted resource. The attacker supplies input that Citrix Workspace App uses to construct a target file path. The application then reads, writes, or deletes the attacker-chosen path with the privileges of the Workspace App process.

No verified proof-of-concept code is publicly available. Refer to the Citrix Support Article CTX696911 for vendor-authorized technical details.

Detection Methods for CVE-2026-18751

Indicators of Compromise

Unexpected file creation, modification, or deletion in directories writable by the Citrix Workspace App process on macOS.
Presence of symbolic links or relative path traversal sequences (../) within Workspace App configuration files, session profiles, or ICA files.
Workspace App version reporting as 2607 on managed macOS endpoints.

Detection Strategies

Inventory macOS endpoints and identify hosts running Citrix Workspace App version 2607 using MDM or endpoint management tooling.
Monitor filesystem telemetry for the Workspace App process performing writes to paths outside its expected working directories such as ~/Library/Application Support/Citrix Receiver/.
Alert on Workspace App child processes or file operations that touch sensitive locations including user LaunchAgents, shell startup files, or system directories.

Monitoring Recommendations

Enable macOS Unified Logging and endpoint file integrity monitoring for Workspace App directories and any path referenced through ICA configuration.
Correlate Workspace App activity with user session events to detect anomalous file operations following user interaction with untrusted ICA or configuration content.
Track integrity of Workspace App configuration files and application bundles to catch unauthorized modifications.

How to Mitigate CVE-2026-18751

Immediate Actions Required

Identify all macOS endpoints running Citrix Workspace App version 2607 and prioritize them for remediation.
Apply the fixed Workspace App release referenced in Citrix Support Article CTX696911 as soon as it is available in your change window.
Restrict distribution of ICA files and Workspace App configuration profiles to trusted, signed sources only.

Patch Information

Citrix documents the vulnerability and remediation guidance in Citrix Support Article CTX696911. Administrators should upgrade Citrix Workspace App for macOS to the fixed version specified in that advisory. Verify installed version after upgrade and remove any residual copies of the 2607 build from user systems.

Workarounds

Limit user permissions on macOS endpoints so that Workspace App runs under standard user accounts without administrative rights.
Block delivery of untrusted ICA files or configuration content through email gateways and web filters until patching is complete.
Use MDM policies to prevent execution of Citrix Workspace App version 2607 on managed macOS devices where feasible.

bash

# Verify installed Citrix Workspace App version on macOS
defaults read "/Applications/Citrix Workspace.app/Contents/Info.plist" CFBundleShortVersionString

# List potential ICA files that could carry crafted path input
find ~/Downloads ~/Desktop -type f -name "*.ica" -print