EUVD-2026-31387
GHSA-m2r4-jq7j-hchx
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Primary rating from Vendor (hackerone) · only source for this CVE.
CVSS VectorVendor: hackerone
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
A malicious actor with access to the network and low privileges could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to obtain sensitive information.
AnalysisAI
Path traversal in Ubiquiti UniFi OS devices allows authenticated low-privileged network attackers to read arbitrary files on the underlying device filesystem, enabling disclosure of sensitive information such as configuration data, credentials, or cryptographic material. The flaw (CVSS 7.7, scope-changed) affects a broad fleet of UniFi gateways, cloud keys, NVRs, and NAS appliances. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Technical ContextAI
UniFi OS is the embedded Linux-based management platform Ubiquiti ships across its Dream Machine (UDM/UDR/UCG), Cloud Key (UCK/UCKP), Network Video Recorder (UNVR/ENVR), and UniFi NAS (UNAS) appliances, exposing a web/API surface for device administration. The weakness is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), meaning a request parameter or path component is concatenated into a filesystem operation without canonicalization, so '../' sequences or absolute paths escape the intended directory. Because UniFi OS runs privileged services that touch system files, traversal reads can reach OS-level resources outside the application's intended jail, which explains the CVSS Scope:Changed designation.
RemediationAI
Patch available per vendor advisory - upgrade affected UniFi OS appliances to the firmware revisions listed in Ubiquiti Security Advisory Bulletin 064 (https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b); exact fix versions per model are documented there and should be applied via the UniFi controller or device UI. As compensating controls until the update is staged, restrict the UniFi management interface to a dedicated management VLAN and block it from general user networks at the firewall, remove unnecessary local UniFi user accounts and tighten role assignments so untrusted parties do not hold even low-privileged credentials, and disable remote/Site Manager access for the affected devices (trade-off: loss of cloud-based remote administration). Rotate any credentials, API tokens, or backup-encryption secrets stored on the device after patching, since prior read-access by a low-privileged user cannot be ruled out from logs alone.
More in Unifi Os Server
View allUnauthenticated command injection in Ubiquiti UniFi OS devices allows remote attackers with network access to execute ar
Path traversal in Ubiquiti UniFi OS devices allows network-adjacent attackers to read sensitive files from the underlyin
Unauthorized system modification on Ubiquiti UniFi OS devices allows network-adjacent attackers to alter device configur
Authenticated command injection in Ubiquiti UniFi OS allows low-privileged network-adjacent attackers to execute arbitra
Privilege escalation in Ubiquiti UniFi OS allows a low-privileged attacker with network access to elevate privileges on
Command injection in Ubiquiti UniFi OS devices allows a high-privileged attacker on the network to execute arbitrary ope
Command injection in Ubiquiti UniFi OS (all builds before 5.1.19) lets a low-privileged user on the same network run arb
Privilege escalation in Ubiquiti UniFi OS allows a low-privileged, network-adjacent user to chain a series of authentica
Privilege escalation via Server-Side Request Forgery affects Ubiquiti UniFi OS devices and the UniFi OS Server across th
Authentication bypass in Ubiquiti UniFi OS devices allows a network-adjacent attacker to abuse a path traversal flaw (CW
Information disclosure in Ubiquiti UniFi OS devices allows unauthenticated network-adjacent attackers to read sensitive
Cross-site session abuse in Ubiquiti UniFi OS lets a remote attacker who lures an authenticated operator to a malicious
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today