EUVD-2026-36381
GHSA-4wqw-89qw-8r56
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Network-reachable management endpoint with no auth or UI (AV:N/AC:L/PR:N/UI:N); path traversal reads files beyond the web component's authority (S:C, C:H); read-only flaw, so I:N/A:N.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
Lifecycle Timeline
2DescriptionCVE.org
A malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices running UniFi OS to obtain data from such UniFi OS devices or instances.
Articles & Coverage 1
AnalysisAI
Information disclosure in Ubiquiti UniFi OS devices allows unauthenticated network-adjacent attackers to read sensitive data via a path traversal flaw (CWE-22). The high CVSS 8.6 score reflects a scope change with high confidentiality impact, indicating that disclosed data can affect resources beyond the vulnerable component itself. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Technical ContextAI
UniFi OS is the embedded operating system that powers Ubiquiti's gateway, NVR, NAS, and cloud-key device families (UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, UDM-Beast, EFG, UDW, UDR, Express, UNVR, UNAS, UCK, UCG, etc.) as well as the UniFi OS Server software. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) typically manifests when a web or API endpoint accepts a user-supplied filename or path parameter and concatenates it into a filesystem operation without canonicalizing or whitelisting, allowing traversal sequences such as '../' to escape the intended directory. Because the CVSS scope flag is Changed (S:C), the disclosed data likely crosses a trust/authority boundary - for example, the management web service reading files owned by another component or by the underlying OS.
RemediationAI
Patch available per vendor advisory: upgrade affected UniFi OS devices and UniFi OS Server installations to the firmware versions listed in Ubiquiti Security Advisory Bulletin 065 (https://community.ui.com/releases/Security-Advisory-Bulletin-065-065/aa46a22b-fc43-4eae-9382-6fc8feda967a) - specific fix versions were not included in the supplied input and must be read from that advisory. Until devices can be updated, restrict reachability of the UniFi OS management plane (typically the HTTPS web UI and associated API ports such as 443/TCP and 8443/TCP) to a dedicated management VLAN or VPN, and explicitly block access from untrusted LAN segments and the WAN interface; the trade-off is that remote browser-based administration and any third-party integrations that talk to the UniFi API will need to traverse the same restricted path. Additionally, audit web/access logs for unexpected requests containing traversal sequences ('../', URL-encoded '%2e%2e%2f', or unusual filename parameters) hitting UniFi OS endpoints, and rotate any credentials, API tokens, or backup-encryption secrets that may have been retrievable via filesystem read on the device.
qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for
Authentication bypass in Ubiquiti UniFi OS lets a network-adjacent, unauthenticated attacker abuse improper neutralizati
Authenticated command injection in Ubiquiti UniFi OS allows low-privileged network-adjacent attackers to execute arbitra
Privilege escalation in Ubiquiti UniFi OS allows a low-privileged attacker with network access to elevate privileges on
A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in
Authentication bypass in Ubiquiti UniFi OS lets a network-adjacent attacker circumvent login on affected devices by inje
Denial of Service vulnerability in Multer (Node.js multipart form-data middleware) affecting versions 1.4.4-lts.1 throug
Servify Express, a Node.js package for starting Express servers, contains a denial of service vulnerability caused by th
The Express web framework before 3.11 and 4.x before 4.5 for Node.js does not provide a charset field in HTTP Content-Ty
Express.js minimalist web framework for node. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitab
The EXPRESS (aka com.gpshopper.express.android) application 2.5.3 for Android does not verify X.509 certificates from SS
Reflected cross-site scripting (XSS) in Smoothwall Express versions before 3.1 Update 13 allows unauthenticated remote a
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today