EUVD-2026-36381
GHSA-4wqw-89qw-8r56
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Network-reachable management endpoint with no auth or UI (AV:N/AC:L/PR:N/UI:N); path traversal reads files beyond the web component's authority (S:C, C:H); read-only flaw, so I:N/A:N.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
A malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices running UniFi OS to obtain data from such UniFi OS devices or instances.
Articles & Coverage 1
AnalysisAI
Information disclosure in Ubiquiti UniFi OS devices allows unauthenticated network-adjacent attackers to read sensitive data via a path traversal flaw (CWE-22). The high CVSS 8.6 score reflects a scope change with high confidentiality impact, indicating that disclosed data can affect resources beyond the vulnerable component itself. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Technical ContextAI
UniFi OS is the embedded operating system that powers Ubiquiti's gateway, NVR, NAS, and cloud-key device families (UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, UDM-Beast, EFG, UDW, UDR, Express, UNVR, UNAS, UCK, UCG, etc.) as well as the UniFi OS Server software. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) typically manifests when a web or API endpoint accepts a user-supplied filename or path parameter and concatenates it into a filesystem operation without canonicalizing or whitelisting, allowing traversal sequences such as '../' to escape the intended directory. Because the CVSS scope flag is Changed (S:C), the disclosed data likely crosses a trust/authority boundary - for example, the management web service reading files owned by another component or by the underlying OS.
RemediationAI
Patch available per vendor advisory: upgrade affected UniFi OS devices and UniFi OS Server installations to the firmware versions listed in Ubiquiti Security Advisory Bulletin 065 (https://community.ui.com/releases/Security-Advisory-Bulletin-065-065/aa46a22b-fc43-4eae-9382-6fc8feda967a) - specific fix versions were not included in the supplied input and must be read from that advisory. Until devices can be updated, restrict reachability of the UniFi OS management plane (typically the HTTPS web UI and associated API ports such as 443/TCP and 8443/TCP) to a dedicated management VLAN or VPN, and explicitly block access from untrusted LAN segments and the WAN interface; the trade-off is that remote browser-based administration and any third-party integrations that talk to the UniFi API will need to traverse the same restricted path. Additionally, audit web/access logs for unexpected requests containing traversal sequences ('../', URL-encoded '%2e%2e%2f', or unusual filename parameters) hitting UniFi OS endpoints, and rotate any credentials, API tokens, or backup-encryption secrets that may have been retrievable via filesystem read on the device.
More in Unifi Os Server
View allUnauthenticated command injection in Ubiquiti UniFi OS devices allows remote attackers with network access to execute ar
Path traversal in Ubiquiti UniFi OS devices allows network-adjacent attackers to read sensitive files from the underlyin
Unauthorized system modification on Ubiquiti UniFi OS devices allows network-adjacent attackers to alter device configur
Authenticated command injection in Ubiquiti UniFi OS allows low-privileged network-adjacent attackers to execute arbitra
Privilege escalation in Ubiquiti UniFi OS allows a low-privileged attacker with network access to elevate privileges on
Command injection in Ubiquiti UniFi OS devices allows a high-privileged attacker on the network to execute arbitrary ope
Command injection in Ubiquiti UniFi OS (all builds before 5.1.19) lets a low-privileged user on the same network run arb
Privilege escalation in Ubiquiti UniFi OS allows a low-privileged, network-adjacent user to chain a series of authentica
Privilege escalation via Server-Side Request Forgery affects Ubiquiti UniFi OS devices and the UniFi OS Server across th
Authentication bypass in Ubiquiti UniFi OS devices allows a network-adjacent attacker to abuse a path traversal flaw (CW
Path traversal in Ubiquiti UniFi OS devices allows authenticated low-privileged network attackers to read arbitrary file
Cross-site session abuse in Ubiquiti UniFi OS lets a remote attacker who lures an authenticated operator to a malicious
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today