EUVD-2026-31384
GHSA-95fp-244g-g3vr
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Primary rating from Vendor (hackerone) · only source for this CVE.
CVSS VectorVendor: hackerone
Lifecycle Timeline
3DescriptionCVE.org
A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to access an underlying account.
AnalysisAI
Path traversal in Ubiquiti UniFi OS devices allows network-adjacent attackers to read sensitive files from the underlying system, which can then be leveraged to take over an underlying account. The flaw carries a maximum CVSS 10.0 score reflecting unauthenticated network exploitation with scope change and full confidentiality, integrity, and availability impact across a broad fleet of UniFi gateways, cameras, NVRs, and NAS appliances. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Technical ContextAI
The vulnerability is a CWE-22 Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) issue in UniFi OS, the Linux-based operating system that runs on Ubiquiti's UniFi gateways and appliances. Path traversal occurs when user-supplied input is concatenated into filesystem paths without canonicalization, allowing sequences such as '../' to escape the intended directory and reach arbitrary files outside the web/application root. Affected platforms identified by CPE include the UniFi OS Server and Dream Machine line (UDM, UDM Pro, UDM SE, UDM Pro Max, UDM Beast), Express/Fiber Gateway (EFG), UDW, UDR/UDR7, and per the advisory tags also Express 7, UNVR family, Envr/Envr Core, UNAS family, Cloud Key (UCKP, UCK, UCK Enterprise) and Cloud Gateway (UCG Ultra/Max/Fiber/Industrial) devices, all running the UniFi OS stack.
RemediationAI
Patch available per vendor advisory - apply the firmware updates listed in Ubiquiti Security Advisory Bulletin 064 (https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b) for each affected UniFi OS device class as soon as the vendor-supplied build is available for your hardware; exact patched version numbers are not provided in the input data and should be read directly from the advisory. As a compensating control until devices are updated, restrict reachability of the UniFi OS management interface to a dedicated management VLAN or trusted jump host and ensure remote/WAN access (including any port-forwards or UI Remote-style exposure) is disabled, since the description explicitly requires network access to the device; firewalling the management ports has the side effect of breaking remote administration and any integrations that rely on direct API access, so plan for an out-of-band management path. Auditing UniFi OS local accounts and rotating credentials after patching is prudent because the advisory states the file-read primitive can be escalated to take over an underlying account.
Unauthenticated command injection in Ubiquiti UniFi OS devices allows remote attackers with network access to execute ar
Unauthorized system modification on Ubiquiti UniFi OS devices allows network-adjacent attackers to alter device configur
free5gc UDM provides Unified Data Management (UDM) for free5GC, an open-source project for 5th generation (5G) mobile co
free5gc UDM provides Unified Data Management (UDM) for free5GC, an open-source project for 5th generation (5G) mobile co
Remote attackers can inject control characters into the SUPI parameter of free5GC UDM versions up to 1.4.1, causing URL
Authenticated command injection in Ubiquiti UniFi OS allows low-privileged network-adjacent attackers to execute arbitra
Privilege escalation in Ubiquiti UniFi OS allows a low-privileged attacker with network access to elevate privileges on
free5gc UDM provides Unified Data Management (UDM) for free5GC, an open-source project for 5th generation (5G) mobile co
Information disclosure in Ubiquiti UniFi OS devices allows unauthenticated network-adjacent attackers to read sensitive
Improper access control in Ubiquiti UniFi OS allows network-adjacent attackers to make unauthorized configuration change
Path traversal in Ubiquiti UniFi OS devices allows authenticated low-privileged network attackers to read arbitrary file
pkg/suci/suci.go in free5GC udm before 1.2.0, when Go before 1.19 is used, allows an Invalid Curve Attack because it may
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today