Intel

CVE-2026-34911

unifi_os_server: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CVE-2026-34911)

highEPSS 0.6%

Affected

  • ui/unifi_os_server lt *..5.0.8
  • ui/unifi_cloud_gateway_industrial_firmware lt *..5.1.12
  • ui/unifi_dream_machine_firmware lt *..5.1.12
  • ui/unifi_dream_machine_pro_firmware lt *..5.1.12
  • ui/unifi_dream_machine_special_edition_firmware lt *..5.1.12
  • ui/unifi_dream_machine_pro_max_firmware lt *..5.1.12
  • ui/enterprise_fortress_gateway_firmware lt *..5.1.12
  • ui/unifi_dream_wall_firmware lt *..5.1.12
  • ui/unifi_dream_router_firmware lt *..5.1.12
  • ui/unifi_dream_router_7_firmware lt *..5.1.12
  • ui/unifi_express_7_firmware lt *..5.1.12
  • ui/unifi_network_video_recorder_firmware lt *..5.1.12
  • ui/unifi_network_video_recorder_pro_firmware lt *..5.1.12
  • ui/unifi_network_video_recorder_instant_firmware lt *..5.1.12
  • ui/enterprise_network_video_recorder_firmware lt *..5.1.12
  • ui/unifi_cloud_gateway_ultra_firmware lt *..5.1.12
  • ui/unifi_cloud_gateway_max_firmware lt *..5.1.12
  • ui/unifi_cloud_gateway_fiber_firmware lt *..5.1.12
  • ui/unifi_dream_router_5g_max_firmware lt *..5.1.12
  • ui/enterprise_network_video_recorder_core_firmware lt *..5.1.12
  • ui/unifi_cloud_key_plus_firmware lt *..5.1.12
  • ui/unifi_cloudkey_firmware lt *..5.1.12
  • ui/unifi_cloudkey_enterprise_firmware lt *..5.1.12
  • ui/unifi_network_video_recorder_g2_firmware lt *..5.1.12
  • ui/unifi_network_video_recorder_g2_pro_firmware lt *..5.1.12
  • ui/unifi_dream_machine_beast_firmware lt *..5.1.11
  • ui/unas_2_firmware lt *..5.1.10
  • ui/unas_4_firmware lt *..5.1.10
  • ui/unas_pro_firmware lt *..5.1.10
  • ui/unas_pro_4_firmware lt *..5.1.10
  • ui/unas_pro_8_firmware lt *..5.1.10

Description

A malicious actor with access to the network and low privileges could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to obtain sensitive information.

Source: BSI CSAFBSI WID PortalNVD (NIST)CVE.org (MITRE)ENISA EUVDcvelistv5

Affected operating systems

  • other

    ui / enterprise_fortress_gateway_firmware

  • other

    ui / enterprise_network_video_recorder_core_firmware

  • other

    ui / enterprise_network_video_recorder_firmware

  • other

    ui / unas_2_firmware

  • other

    ui / unas_4_firmware

  • other

    ui / unas_pro_4_firmware

  • other

    ui / unas_pro_8_firmware

  • other

    ui / unas_pro_firmware

  • other

    ui / unifi_cloud_gateway_fiber_firmware

  • other

    ui / unifi_cloud_gateway_industrial_firmware

  • other

    ui / unifi_cloud_gateway_max_firmware

  • other

    ui / unifi_cloud_gateway_ultra_firmware

  • other

    ui / unifi_cloud_key_plus_firmware

  • other

    ui / unifi_cloudkey_enterprise_firmware

  • other

    ui / unifi_cloudkey_firmware

  • other

    ui / unifi_dream_machine_beast_firmware

  • other

    ui / unifi_dream_machine_firmware

  • other

    ui / unifi_dream_machine_pro_firmware

  • other

    ui / unifi_dream_machine_pro_max_firmware

  • other

    ui / unifi_dream_machine_special_edition_firmware

  • other

    ui / unifi_dream_router_5g_max_firmware

  • other

    ui / unifi_dream_router_7_firmware

  • other

    ui / unifi_dream_router_firmware

  • other

    ui / unifi_dream_wall_firmware

Affected products

The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

uiunifi_os_server
5.0.8fixed from 5.0.8

Metrics

XIEM Effective CVSS
7.7
Source: nvd-v3
EPSS percentile
46.7 %
High — this CVE ranks above the median of all CVEs scored today (rank ≥ 36%).
KEV status
—
Show all metrics
Severity
high
Priority score
74.60
Exploit maturity
no public PoC known
CVSS v3
7.7
EPSS score
0.6 %
Low — model estimates < 1% exploitation likelihood.
Published
2026-05-22 02:16 UTC
CWE
CWE-22

Weakness classes (CWE)

  • CWE-22Base

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

    The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

    cwe.mitre.org →

References & sources

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. CVE Translated2026-07-23 16:10 UTC· nvd@nist.gov
    • Translation: Title: varios productos de Ubiquiti, Description: Un actor malicioso con acceso a la red y privilegios bajos podría explotar una vulnerabilidad de salto de ruta encontrada en dispositivos UniFi OS para acceder a archivos en el sistema subyacente que podrían ser manipulados para obtener información sensible.
  2. Initial Analysis2026-06-24 15:15 UTC· nvd@nist.gov
    • CPE Configuration: OR *cpe:2.3:a:ui:unifi_os_server:*:*:*:*:*:*:*:* versions up to (excluding) 5.0.8
    • CPE Configuration: AND OR *cpe:2.3:o:ui:unifi_cloud_gateway_industrial_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 5.1.12 OR cpe:2.3:h:ui:unifi_cloud_gateway_industrial:-:*:*:*:*:*:*:*
    • CPE Configuration: AND OR *cpe:2.3:o:ui:unifi_dream_machine_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 5.1.12 OR cpe:2.3:h:ui:unifi_dream_machine:-:*:*:*:*:*:*:*
    • CPE Configuration: AND OR *cpe:2.3:o:ui:unifi_dream_machine_pro_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 5.1.12 OR cpe:2.3:h:ui:unifi_dream_machine_pro:-:*:*:*:*:*:*:*

Linked advisories