CVE-2026-2638

Vulnerability

A vulnerability exists in the quarantine and restore workflow of the X-VPN macOS website, specifically affecting versions 77.0 through 77.5 [4]. This issue is rooted in a race condition during file quarantine processing and improper handling of symbolic links during restoration [4]. The Download Protection feature, which scans and quarantines files, runs with administrator-level permissions, making it susceptible to manipulation [1].

Exploitation

A local attacker can exploit this vulnerability by leveraging a race condition to influence file contents during quarantine and then manipulating the file path with a symbolic link before restoration occurs [4]. The ApiRestoreQuarantinedFiles routine, running with root privileges via the X-VPN_root service, will follow this attacker-controlled symlink, allowing the application to write restored data to an arbitrary file [4].

Impact

Successful exploitation allows an attacker to achieve privileged file corruption, potentially leading to arbitrary corruption of root-owned files or controlled prefix overwrites of privileged targets [4]. This could affect security-sensitive files such as privileged scripts or cron entries, potentially resulting in further privilege escalation or system compromise. For instance, an attacker could overwrite the /etc/sudoers file to grant themselves passwordless root privileges [4].

Mitigation

X-VPN has released a fix for this vulnerability in X-VPN macOS website version 77.5.1 [1]. Users of affected versions should update to version 77.5.1 or later as soon as possible. No in-the-wild exploitation has been observed [1].