EUVD-2026-31387
GHSA-m2r4-jq7j-hchx
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Primary rating from Vendor (hackerone) · only source for this CVE.
CVSS VectorVendor: hackerone
Lifecycle Timeline
2DescriptionCVE.org
A malicious actor with access to the network and low privileges could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to obtain sensitive information.
AnalysisAI
Path traversal in Ubiquiti UniFi OS devices allows authenticated low-privileged network attackers to read arbitrary files on the underlying device filesystem, enabling disclosure of sensitive information such as configuration data, credentials, or cryptographic material. The flaw (CVSS 7.7, scope-changed) affects a broad fleet of UniFi gateways, cloud keys, NVRs, and NAS appliances. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Technical ContextAI
UniFi OS is the embedded Linux-based management platform Ubiquiti ships across its Dream Machine (UDM/UDR/UCG), Cloud Key (UCK/UCKP), Network Video Recorder (UNVR/ENVR), and UniFi NAS (UNAS) appliances, exposing a web/API surface for device administration. The weakness is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), meaning a request parameter or path component is concatenated into a filesystem operation without canonicalization, so '../' sequences or absolute paths escape the intended directory. Because UniFi OS runs privileged services that touch system files, traversal reads can reach OS-level resources outside the application's intended jail, which explains the CVSS Scope:Changed designation.
RemediationAI
Patch available per vendor advisory - upgrade affected UniFi OS appliances to the firmware revisions listed in Ubiquiti Security Advisory Bulletin 064 (https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b); exact fix versions per model are documented there and should be applied via the UniFi controller or device UI. As compensating controls until the update is staged, restrict the UniFi management interface to a dedicated management VLAN and block it from general user networks at the firewall, remove unnecessary local UniFi user accounts and tighten role assignments so untrusted parties do not hold even low-privileged credentials, and disable remote/Site Manager access for the affected devices (trade-off: loss of cloud-based remote administration). Rotate any credentials, API tokens, or backup-encryption secrets stored on the device after patching, since prior read-access by a low-privileged user cannot be ruled out from logs alone.
More in Unifi Os Server
View allUnauthenticated command injection in Ubiquiti UniFi OS devices allows remote attackers with network access to execute ar
Path traversal in Ubiquiti UniFi OS devices allows network-adjacent attackers to read sensitive files from the underlyin
Unauthorized system modification on Ubiquiti UniFi OS devices allows network-adjacent attackers to alter device configur
Authentication bypass in Ubiquiti UniFi OS lets a network-adjacent, unauthenticated attacker abuse improper neutralizati
Privilege escalation in Ubiquiti UniFi OS lets a low-privileged actor with network access to an affected device elevate
Privilege escalation in Ubiquiti UniFi OS devices allows a network-adjacent attacker holding a low-privileged account to
Authenticated command injection in Ubiquiti UniFi OS allows low-privileged network-adjacent attackers to execute arbitra
Privilege escalation in Ubiquiti UniFi OS allows a low-privileged attacker with network access to elevate privileges on
Command injection in Ubiquiti UniFi OS Server allows an attacker holding high-privilege access and network reachability
Command injection in Ubiquiti UniFi OS Server allows an attacker holding high-privilege (administrative) access on the n
Command injection in Ubiquiti UniFi OS devices allows a high-privileged attacker on the network to execute arbitrary ope
Authentication bypass in Ubiquiti UniFi OS lets a network-adjacent attacker circumvent login on affected devices by inje
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today