Citrix UniconOS contains a flaw that permits an attacker to read or write any file on the system. This can disclose sensitive data, modify configuration or executable files, or introduce malicious code, potentially leading to full system compromise. The vulnerability is linked to CWE-22, indicating uncontrolled access to file paths.

The flaw affects all installations of Citrix UniconOS that are older than version 2607.2 CR and older than 2603 LTSR CU2. Specifically, any system running a release before 2607.2 CR or before 2603 LTSR CU2 is vulnerable.

The CVSS score of 5.1 indicates a moderate risk profile. The EPSS score of less than 1% suggests a low likelihood of widespread exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The description does not specify the attack vector; it is inferred that an attacker would need to exploit a component of UniconOS that processes file names or paths, possibly via a logged‑in session or through a remote service that accepts file operations. The impact remains significant because the flaw enables both read and write access to arbitrary files.