EUVD-2026-41393
GHSA-97wr-fjqp-fxmr
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network-reachable path traversal (PR:N, AV:N, AC:L) yielding arbitrary file read, so C:H with no integrity or availability impact.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi Protect Floodlight devices to access files on the UniFi Protect Floodlight.
AnalysisAI
Arbitrary file disclosure in Ubiquiti UniFi Protect Floodlight devices lets a network-adjacent attacker read files on the device via path traversal, exposing potentially sensitive local data. The flaw (CWE-22) is remotely reachable without authentication per the CVSS vector (PR:N) and carries high confidentiality impact but no integrity or availability effect. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network-level access to the UniFi Protect Floodlight device - the attacker must be able to reach the device's file-serving endpoint on the local/management network (the description explicitly scopes it to 'a malicious actor with access to the network'). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are moderate and largely consistent. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has gained a foothold on the LAN or Wi-Fi segment where a UniFi Protect Floodlight resides sends a crafted request to the device's file-handling endpoint containing directory-traversal sequences (e.g., '../../') to escape the intended directory. The device returns the contents of arbitrary local files, potentially leaking configuration, credentials, or other sensitive data. … |
| Remediation | Apply the firmware update referenced in Ubiquiti Security Advisory Bulletin 066 (https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc); a patch is available per the vendor advisory, though the exact fixed firmware version is not enumerated in the provided data and should be confirmed from the bulletin. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
24 hours: Inventory all UniFi Protect Floodlight devices and assess network accessibility (whether reachable from untrusted networks or external interfaces). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today