EUVD-2026-41385
GHSA-h9fm-m325-j8cf
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H
Network-reachable and low-complexity but requires high app privileges (PR:H); path traversal escapes the app to write on the host (S:C) yielding I:H/A:H with no disclosure (C:N).
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
A malicious actor with access to the network and high privileges could exploit a Path Traversal vulnerability found in self-hosted instances of UniFi Network Application to escalate write permission on the host device.
AnalysisAI
Privilege escalation via path traversal in self-hosted UniFi Network Application (Ubiquiti's controller software) allows an authenticated, high-privileged attacker with network access to write files outside intended directories and escalate write permissions on the underlying host. The CVSS 3.1 base score is 8.7 with a scope change, reflecting that the flaw lets the application's write capability break out to affect the host system beyond the application's security boundary. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; it was reported through HackerOne and addressed in Ubiquiti Security Advisory Bulletin 066.
Technical ContextAI
The affected component is the UniFi Network Application (CPE cpe:2.3:a:ubiquiti_inc:unifi_network_application), the self-hosted management controller used to provision and monitor Ubiquiti UniFi networking hardware. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, i.e. Path Traversal): user-influenced path input is not properly canonicalized or constrained, allowing '../' style sequences to reference files outside the intended directory. Because the application process holds write privileges on the host, an attacker who can steer a write operation to an arbitrary path can place or modify files on the host filesystem, which is why the CVSS scope is marked Changed (S:C) - the impact crosses from the application into the host operating environment.
RemediationAI
Patch available per vendor advisory: upgrade the self-hosted UniFi Network Application to the fixed build identified in Ubiquiti Security Advisory Bulletin 066 (https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc); an exact patched version number is not included in the provided data and should be taken directly from that advisory. Until the update is applied, reduce exposure by restricting network access to the controller's management interface to trusted administrative hosts/VLANs only (limiting who can reach the network vector), and by tightly limiting the number of accounts holding high privileges, since exploitation requires PR:H - trade-off: over-restricting admin access can disrupt legitimate multi-operator management. Where feasible, run the controller under a least-privilege service account and constrain its filesystem write permissions on the host so a traversal cannot reach sensitive system paths, accepting that overly aggressive filesystem restrictions may break legitimate controller operations such as backups or updates.
More in Unifi Network Application
View allPrivilege escalation in Ubiquiti's UniFi Network Application allows an already-authenticated, high-privileged user with
Authenticated command injection in Ubiquiti's UniFi Network Application (the controller software managing UniFi network
A backup file vulnerability found in UniFi applications (Version 7.3.83 and earlier) running on Linux operating systems
Privilege escalation in Ubiquiti's UniFi Network Application allows a low-privileged, network-adjacent user to gain elev
Privilege escalation in Ubiquiti's UniFi Network Application allows a low-privileged, authenticated user on the network
A Command Injection vulnerability found in a Self-Hosted UniFi Network Servers (Linux) with UniFi Network Application (V
Privilege persistence in Ubiquiti's UniFi Network Application allows a low-privileged network-adjacent actor to retain g
Denial of service in Ubiquiti's UniFi Network Application allows a remote, unauthenticated attacker with network access
Instances of UniFi Network Application that (i) are run on a UniFi Gateway Console, and (ii) are versions 7.5.176. Rated
A Cross-Site Scripting (XSS) vulnerability found in UniFi Network (Version 7.3.83 and earlier) allows a malicious actor
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today