What is the CVSS score of CVE-2026-55111?

CVE-2026-55111 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of UniFi Protect Floodlight are affected by CVE-2026-55111?

Ubiquiti UniFi Protect Floodlight devices contain an unauthenticated remote path traversal vulnerability (CVE-2026-55111) enabling arbitrary file disclosure of sensitive device data without…. A patch is available.

How to fix or mitigate CVE-2026-55111?

24 hours: Inventory all UniFi Protect Floodlight devices and assess network accessibility (whether reachable from untrusted networks or external interfaces). 7 days: Apply Ubiquiti Security Advisory Bulletin 066 patch to all affected devices, prioritizing those on external-facing or less-controlled network segments. 30 days: Verify 100% patch deployment completion, review device access logs for suspicious file read attempts, and document remediation evidence for audit.

UniFi Protect Floodlight CVE-2026-55111

EUVD-2026-41393 HIGH

Path Traversal (CWE-22)

2026-07-02 hackerone

GHSA-97wr-fjqp-fxmr

Ubiquiti Path Traversal Unifi Protect Floodlight

7.5

CVSS 3.1 · Vendor: hackerone

Severity by source

Vendor (hackerone) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network-reachable path traversal (PR:N, AV:N, AC:L) yielding arbitrary file read, so C:H with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (hackerone).

CVSS VectorVendor: hackerone

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 02, 2026 - 16:17 EUVD

Analysis Generated

Jul 02, 2026 - 15:36 vuln.today

DescriptionCVE.org

A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi Protect Floodlight devices to access files on the UniFi Protect Floodlight.

AnalysisAI

Arbitrary file disclosure in Ubiquiti UniFi Protect Floodlight devices lets a network-adjacent attacker read files on the device via path traversal, exposing potentially sensitive local data. The flaw (CWE-22) is remotely reachable without authentication per the CVSS vector (PR:N) and carries high confidentiality impact but no integrity or availability effect. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV; Ubiquiti has issued a fix via Security Advisory Bulletin 066.

Technical ContextAI

UniFi Protect Floodlight is a network-connected smart security camera/lighting device in Ubiquiti's UniFi Protect ecosystem, managed over the local network and typically integrated with a UniFi Protect controller (NVR). The vulnerability is a classic CWE-22 Improper Limitation of a Pathname to a Restricted Directory (path traversal), in which a request-supplied file path is not properly canonicalized or confined to an intended directory, allowing sequences such as '../' to escape into the broader filesystem. The single affected CPE is cpe:2.3:a:ubiquiti_inc:unifi_protect_floodlight, indicating the flaw resides in the device's on-board application/firmware service that handles file or resource requests.

RemediationAI

Apply the firmware update referenced in Ubiquiti Security Advisory Bulletin 066 (https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc); a patch is available per the vendor advisory, though the exact fixed firmware version is not enumerated in the provided data and should be confirmed from the bulletin. Enable automatic firmware updates in the UniFi Protect controller so the floodlight receives the fix. Until patched, restrict network access to the device by placing UniFi Protect cameras and floodlights on a dedicated, isolated management VLAN with no untrusted client access, and block reachability of the device's local web/API service from general user and guest networks - the trade-off is added network-segmentation overhead and possible disruption to integrations that reach the device directly. Since the attacker requires network access, tightening who can reach the device is the most effective compensating control until firmware is updated.