A path traversal flaw in the UniFi Network Application allows an adversary with network access to read arbitrary files on the host and potentially manipulate files to gain access to underlying account credentials.

The vulnerability affects Ubiquiti Inc's UniFi Network Application. No specific version information is supplied, so all installations should be considered at risk until vendor-disclosed details are available.

The CVSS score of 10 indicates maximum severity. EPSS data is not available and the vulnerability is not listed in CISA's KEV catalog. The likely attack vector involves crafting HTTP requests to the UniFi controller over the local network to traverse directories and access files outside the intended scope, which could lead to further compromise if privileged accounts are reached.