A path traversal flaw in the firmware of Ubiquiti UniFi Play devices lets an attacker with network access write arbitrary files to the filesystem, which can be used to execute arbitrary code. The vulnerability is a classic example of a directory traversal weakness leading to remote code execution.

Affected are UniFi Play PowerAmp firmware versions 1.0.35 and earlier, and UniFi Play Audio Port firmware versions 1.0.24 and earlier. The flaw is present only in the firmware of these two devices and is fixed in later releases.

The vulnerability carries a CVSS score of 9.8, indicating critical severity. No EPSS score is available and it has not been listed in the CISA KEV catalog, though it still represents a high risk if exploited. The likely attack vector is a local or remote attacker who can reach the UniFi Play device over the network. Exploitation requires simply accessing the vulnerable firmware endpoint, after which the attacker can write malicious files that the device will execute.