Description
A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protect AI Key to obtain information about files on the device.
Published: 2026-10-14
Score: 3.7 Low
EPSS: < 1% Very Low
KEV: No
Impact: Limited File Enumeration
Action: Immediate Patch
AI Analysis

Impact

A Path Traversal flaw exists in Ubiquiti’s UniFi Protect AI Key that allows an attacker with network access to discover filenames on the device. The flaw does not provide code execution or full system compromise, but it can leak information about the device's file structure and configuration. The vulnerability is classified as a basic input validation weakness (CWE‑22).

Affected Systems

The vulnerability affects Ubiquiti Inc’s UniFi Protect AI Key. No specific firmware versions are listed as affected, so all current releases may be vulnerable until the vendor issues a fix.

Risk and Exploitability

The CVSS score of 3.7 categorizes the issue as low severity. The EPSS score of less than 1% indicates a very low probability of widespread exploitation, and the vulnerability is not listed in the CISA KEV catalog. However, it can be exploited by anyone who can reach the device’s network interface. An attacker would need to craft requests that manipulate path parameters to read data that can reveal internal file names or other sensitive paths. This could aid further attacks if combined with other weaknesses.

Generated by OpenCVE AI on October 16, 2026 at 01:02 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply any firmware update released by Ubiquiti that addresses the path traversal issue.
  • Restrict access to the UniFi Protect AI Key by allowing only trusted management networks or IP ranges through firewall rules.
  • Monitor device logs for unusual file access requests and investigate any anomalous activity.

Generated by OpenCVE AI on October 16, 2026 at 01:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 17 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
First Time appeared Ubiquiti
Ubiquiti unifi Protect Ai Key
Vendors & Products Ubiquiti
Ubiquiti unifi Protect Ai Key

Fri, 16 Oct 2026 01:30:00 +0000

Type Values Removed Values Added
Title Path Traversal Flaw in UniFi Protect AI Key Enables File Enumeration

Thu, 15 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Title Path Traversal in UniFi Protect AI Key Allows Limited File Enumeration

Wed, 14 Oct 2026 16:45:00 +0000

Type Values Removed Values Added
Title Path Traversal in UniFi Protect AI Key Allows Limited File Enumeration

Wed, 14 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 14 Oct 2026 05:30:00 +0000

Type Values Removed Values Added
Description A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protect AI Key to obtain information about files on the device.
Weaknesses CWE-22
References
Metrics cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Ubiquiti Unifi Protect Ai Key
cve-icon MITRE

Status: PUBLISHED

Assigner: Ubiquiti

Published:

Updated: 2026-10-14T14:24:32.381Z

Reserved: 2026-10-14T04:16:43.266Z

Link: CVE-2026-110457

cve-icon Vulnrichment

Updated: 2026-10-14T14:24:22.617Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-14T06:17:05.990

Modified: 2026-10-15T20:38:04.303

Link: CVE-2026-110457

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T11:15:07Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')