CVE-2026-55117: UniFi Access Path Traversal Vulnerability – CVSS 8.6 Analysis

Technical summary

CVE-2026-55117 is a path traversal vulnerability (CWE-22) affecting Ubiquiti's UniFi Access Application. The flaw permits an unauthenticated network-based attacker to traverse the file system and access files outside intended directories. The attack requires no authentication, involves low attack complexity, and produces a network-wide scope impact; the primary concern is unauthorized information disclosure. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) reflects a score of 8.6 (HIGH), indicating significant confidentiality risk with no integrity or availability impact in the base case.

Business impact

Unauthorized file access on UniFi Access Application servers could expose sensitive operational data, configuration details, or credentials stored locally. In deployments where UniFi Access controls physical access, compromise could lead to intelligence gathering for social engineering, targeted lateral movement within the network, or fusion with other attack vectors. Organizations relying on UniFi Access for access control and authentication decisions face a material information disclosure risk that could undermine trust in the system's security posture.

Affected systems

Ubiquiti UniFi Access Application instances accessible over the network are affected. The vulnerability does not require authentication, so any instance reachable from an attacker's network position is at risk. Scope includes all versions until patched; consult Ubiquiti security advisories to determine which versions are vulnerable and when fixes are available.

Exploitability

This vulnerability is readily exploitable. No authentication is required, attack complexity is low, and exploitation can be performed remotely over the network. An attacker with network access can craft path traversal payloads (commonly using sequences like '../' or encoded variants) to request files outside the application's intended document root. The lack of user interaction requirements and broad attack surface make this a practical threat in most network environments.

Remediation

Patch UniFi Access Application to a version that fixes the path traversal input validation. Implement network segmentation to restrict access to the UniFi Access Application to trusted administrative networks only. Apply input validation and canonicalization of file paths before any file system operations. Monitor and log all file access attempts, particularly those containing path traversal patterns, to detect exploitation attempts.

Patch guidance

Contact Ubiquiti or visit their official security advisories page to obtain the patched version of UniFi Access Application. Verify the exact version number and compatibility with your deployment before applying updates. Test patches in a non-production environment first, as access control system changes carry operational risk. Once confirmed, apply patches with scheduled downtime if required, and validate that access control functionality remains intact post-patch.

Detection guidance

Search logs for HTTP requests containing path traversal indicators such as '../', '..\', URL-encoded variants ('%2e%2e'), or file path references pointing outside the application root. Monitor for unexpected file access patterns on the UniFi Access Application server, particularly reads from system directories (/etc, Windows\System32, etc.). Alert on any anomalous access to configuration or credential files. Web application firewalls (WAF) or intrusion detection systems (IDS) can be configured with signatures to block path traversal attempts.

Why prioritize this

This vulnerability merits immediate attention due to its high CVSS score (8.6), unauthenticated attack vector, and confidentiality impact. UniFi Access is typically deployed in critical infrastructure roles (physical access control), making it a target for reconnaissance. The ease of exploitation and potential for credential exposure make this a prime vector for subsequent attacks. Organizations should prioritize patching within days rather than weeks.

Risk score, explained

The CVSS 3.1 score of 8.6 reflects the combination of network accessibility (AV:N), minimal attack complexity (AC:L), no authentication requirement (PR:N), and no user interaction needed (UI:N). The scope change (S:C) indicates impact beyond the vulnerable component. While the vulnerability causes only confidentiality loss (C:H) with no integrity or availability impact in the base metric, the potential to expose authentication material or configuration elevates business risk significantly. This is classified as HIGH severity.

Frequently asked questions