UniFi Network Application EUVD-2026-41385

Exploitation requires a self-hosted instance of UniFi Network Application (Ubiquiti-managed/cloud instances are not in scope) and an attacker who already holds high privileges (PR:H) within the application plus network reachability to it (AV:N). The key limiting factors are: authentication at an administrative/high-privilege level is mandatory, so this is not a remote unauthenticated compromise; the deployment must be the self-hosted variant; and no user interaction is required (UI:N) once those conditions are met. Attack complexity is low (AC:L), meaning that given the privileged foothold, no special timing or race conditions are needed.

The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H, score 8.7) indicates a network-reachable, low-complexity attack that nonetheless requires high privileges (PR:H), meaning the attacker must already hold an administrative/high-privilege foothold in the application. This precondition is the primary limiter: it is not an unauthenticated internet-facing takeover but rather a privilege/impact escalation from an already-trusted position, useful to an insider or an attacker who has compromised admin credentials. Integrity and Availability impacts are High while Confidentiality is None, consistent with a write-oriented traversal rather than data disclosure. No EPSS score, KEV entry, or POC was provided, so exploitation probability cannot be quantified from the input; the absence of KEV and POC suggests no confirmed widespread exploitation, but the high base score plus scope change means it should be prioritized for patching wherever self-hosted controllers are administered by multiple or lower-trust operators. Note: PR:H combined with a self-hosted-only condition materially reduces real-world exposure compared to the raw 8.7 score.

An attacker who has obtained high-privilege (administrative) access to a self-hosted UniFi Network Application - for example via stolen operator credentials or a malicious insider - sends a crafted request whose file path contains directory-traversal sequences. Because the controller process can write to the host, the traversal directs a write operation to an arbitrary host location, letting the attacker modify or plant files and escalate control over the underlying host device. No public exploit code is identified at time of analysis, and the low attack complexity (AC:L) means the technique is straightforward once the privileged foothold exists.