CVE-2026-47368: UniFi OS Path Traversal Vulnerability

CVE-2026-47368 Overview

CVE-2026-47368 is a path traversal vulnerability [CWE-22] affecting certain devices running Ubiquiti UniFi OS. An unauthenticated attacker with network access to an affected device can manipulate file path inputs to read data outside of intended directories. The flaw enables disclosure of sensitive files and configuration data from UniFi OS devices or instances.

The vulnerability is exploitable over the network without authentication or user interaction. Successful exploitation can expose credentials, configuration data, and other sensitive information stored on affected appliances. Ubiquiti documents the issue in the UI Security Advisory Bulletin 065.

Critical Impact
Network-adjacent attackers can read arbitrary files from UniFi OS devices without authentication, exposing configuration data and credentials.

Affected Products

Ubiquiti UniFi OS devices (specific models per vendor advisory)
UniFi OS instances exposing the affected service to network access
Refer to UI Security Advisory Bulletin 065 for the complete list of affected versions

Discovery Timeline

2026-06-12 - CVE-2026-47368 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-47368

Vulnerability Analysis

The vulnerability is a path traversal weakness classified under [CWE-22]: Improper Limitation of a Pathname to a Restricted Directory. Affected UniFi OS endpoints fail to properly sanitize user-supplied path components before resolving them against the device file system. An attacker can submit crafted input containing directory traversal sequences such as ../ to navigate outside the intended document root.

Because the attack vector is network-based and requires no privileges or user interaction, exploitation can occur remotely against any reachable UniFi OS device. The scope is changed, meaning a compromised component can expose data belonging to other security domains on the same device. The impact is limited to confidentiality, with attackers reading files but not modifying them or disrupting service availability.

Root Cause

The root cause is insufficient input validation on file path parameters processed by UniFi OS services. The application accepts attacker-controlled path segments and concatenates them with a base directory without canonicalizing or filtering traversal sequences. This allows resolution of paths outside the intended directory boundary.

Attack Vector

An attacker on the same network as an affected UniFi OS device sends a crafted HTTP request containing path traversal sequences in a vulnerable parameter. The service resolves the manipulated path and returns the contents of files outside the expected directory. Targeted files typically include configuration databases, credential stores, and system files that aid further compromise.

No verified public exploit code is available at the time of publication. The Exploit Prediction Scoring System (EPSS) data indicates a low near-term exploitation probability. See the UI Security Advisory Bulletin 065 for additional technical details.

Detection Methods for CVE-2026-47368

Indicators of Compromise

HTTP request logs containing path traversal sequences such as ../, ..%2f, or %2e%2e%2f targeting UniFi OS management interfaces
Unexpected access to sensitive file paths like /etc/passwd, /etc/shadow, or UniFi configuration files
Anomalous outbound data transfers from UniFi OS devices following inbound network requests
Authentication or API requests from unfamiliar source IP addresses on management VLANs

Detection Strategies

Inspect web server and application logs on UniFi OS devices for URL-encoded or raw traversal patterns in request URIs and query parameters
Deploy network intrusion detection signatures that flag path traversal sequences directed at UniFi management endpoints
Correlate unauthenticated requests with file read operations on sensitive paths using centralized log analysis

Monitoring Recommendations

Forward UniFi OS access logs and syslog output to a centralized SIEM for retention and correlation
Alert on HTTP responses containing sensitive file content signatures returned from UniFi management services
Monitor for repeated 200 OK responses to requests containing traversal characters, which indicate successful file reads

How to Mitigate CVE-2026-47368

Immediate Actions Required

Apply the firmware update referenced in UI Security Advisory Bulletin 065 to all affected UniFi OS devices
Restrict network access to UniFi OS management interfaces using firewall rules and dedicated management VLANs
Audit UniFi OS devices for evidence of unauthorized file access since the device was deployed
Rotate credentials and API keys stored on affected devices after patching

Patch Information

Ubiquiti has published fixed firmware versions in UI Security Advisory Bulletin 065. Administrators should review the advisory for the specific patched versions corresponding to each affected product line and update through the UniFi Network application or device management console.

Workarounds

Block external access to UniFi OS management ports at the network perimeter until patches are applied
Restrict management interface access to a hardened jump host or VPN-connected administrative network
Disable any unused UniFi OS services that expose HTTP endpoints to untrusted networks

bash

# Example firewall rule restricting UniFi OS management access to an admin subnet
iptables -A INPUT -p tcp --dport 443 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP