Citrix ADC - Path Traversal (CVE-2019-19781)

A Path Traversal Vulnerability, CVE-2019-19781 has been identified in Citrix Application Delivery Controller (ADC) and Gateway versions 10.5 through 13.0, allowing attackers to exploit directory traversal flaws. This vulnerability could enable unauthorized access to sensitive files and directories outside the intended web root, potentially leading to information disclosure or further system compromise.

CrowdSec has been tracking this vulnerability and its exploits since 25th of June 2025.

CrowdSec network data shows that most actors exploiting CVE-2019-19781 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. CrowdSec data also reveals a clear uptick in attacks involving CVE-2019-19781 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.

Attackers exploit this vulnerability by sending requests with directory traversal sequences like /vpn/../vpns/cfg/smb.conf to access sensitive configuration files on Citrix ADC and Gateway devices.