---

📋 Overview

A critical unauthenticated path traversal vulnerability (CWE-22) exists in the Ubiquiti UniFi Network Application (UniFi Controller).

An attacker with network access can exploit this flaw to:

• Traverse directory boundaries (../)
• Read and manipulate arbitrary files on the underlying operating system
• Potentially gain unauthorized access to system accounts and achieve full compromise

No authentication or user interaction is required.

CVSS v3.1 Base Score: 10.0 (Critical)
Vector: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

⚠️ This is considered an emergency-level vulnerability — treat it with the highest priority.

🛠 Affected Products & Versions

Product	Affected Versions	Fixed In
UniFi Network Application (Stable)	≤ 10.1.85	10.1.89
UniFi Network Application (Release Candidate)	≤ 10.2.93	10.2.97
UniFi Express (Firmware)	≤ 4.0.12 (or 9.0.114 in some builds)	4.0.13

Confirmed vulnerable examples:

• Official track: 10.1.85 and earlier
• RC track: 10.2.93 and earlier

✅ Fixed Versions

• UniFi Network Application → 10.1.89 (stable) or 10.2.97 (RC)
• UniFi Express → Firmware 4.0.13 or newer

Official Advisory: Security Advisory Bulletin 062

🔥 Impact

• Remote exploitation over the network
• Full read/write access to sensitive files
• Potential account takeover and system compromise
• No user interaction needed
• Changed scope (S:C) increases blast radius

This vulnerability earned the maximum CVSS score of 10.0 due to its ease of exploitation and severe consequences.

🛡️ Recommended Mitigation

1. Update Immediately

• Upgrade your UniFi Network Application to the latest fixed version.
• Update all UniFi Express devices.

2. Temporary Workarounds (if patching is delayed)

• Restrict access to the UniFi Controller management interface (allow only trusted IP addresses)
• Avoid exposing the controller directly to the internet
• Monitor logs for unusual file access attempts

3. Best Practice

• Enable automatic updates where possible
• Regularly check Ubiquiti Community Releases

🔗 References

• NVD - CVE-2026-22557
• Ubiquiti Security Advisory Bulletin 062
• CVE Record
• Discovered by: n00r3 (@izn0u) via HackerOne

Related Vulnerability:

• CVE-2026-22558 — Authenticated NoSQL Injection (CVSS 7.7)

---