EUVD-2026-41395
GHSA-qhch-3mhg-5r99
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Unauthenticated network-reachable traversal (AV:N/AC:L/PR:N/UI:N) reading host files outside the app boundary gives S:C and C:H, with no integrity or availability impact.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
Lifecycle Timeline
2DescriptionCVE.org
A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi Access Application to access files on the host device.
AnalysisAI
Arbitrary file disclosure in Ubiquiti's UniFi Access Application allows a network-adjacent, unauthenticated attacker to read files on the underlying host via path traversal (CWE-22), carrying a CVSS 8.6 rating driven by a scope change and high confidentiality impact. The flaw was reported through HackerOne and addressed in Ubiquiti Security Advisory Bulletin 066. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
UniFi Access is Ubiquiti's physical access-control platform (door readers, controllers, and management software) whose application component runs on UniFi hosts such as the UniFi OS Console/Cloud Gateway family. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), meaning the application accepts a request-supplied path or filename and fails to canonicalize or constrain it, so sequences like '../' escape the intended web/asset root and resolve to arbitrary files on the host filesystem. The single CPE, cpe:2.3:a:ubiquiti_inc:unifi_access_application:*:*:*:*:*:*:*:*, confirms the affected component is the UniFi Access Application software itself rather than firmware or reader hardware. The CVSS scope change (S:C) reflects that the vulnerable web application is used to read files outside its own security boundary - the host operating system - indicating the process can reach OS-level files beyond the application's own data.
RemediationAI
Patch available per vendor advisory: upgrade the UniFi Access Application to the fixed release identified in Ubiquiti Security Advisory Bulletin 066 (https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc); the exact fixed version is not stated in the available input data and must be taken from that advisory, so do not assume a specific build number. If immediate patching is not possible, restrict network reachability of the UniFi Access management application by placing it behind a firewall or dedicated management VLAN and blocking access from untrusted networks and the internet - the trade-off is that legitimate remote administration will require a VPN or jump host. Additionally, avoid exposing the UniFi Access interface directly to the internet and rotate any secrets (API tokens, credentials, keys) that may have been readable on the host if you cannot rule out prior exploitation.
More in Unifi Access Application
View allCommand injection in Ubiquiti's UniFi Access Application allows a low-privileged attacker with network access to run arb
OS command injection in Ubiquiti's UniFi Access Application allows a low-privileged attacker with network reach to run a
Command injection in Ubiquiti's UniFi Access Application allows an authenticated attacker with low privileges and networ
Command injection in Ubiquiti's UniFi Access Application lets a low-privileged attacker with network reach run arbitrary
Privilege escalation in Ubiquiti's UniFi Access Application allows a network-adjacent attacker holding only low-privileg
Privilege escalation in Ubiquiti's UniFi Access Application allows an attacker who already holds high privileges and net
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today