A path traversal vulnerability exists in the UniFi OS device web interface that allows an attacker with limited network access to supply a crafted file path and read arbitrary files from the underlying operating system. The disclosed files may contain sensitive configuration data, authentication credentials or system logs, giving the adversary confidential information that could be used to further compromise the network.

Affected devices include a wide range of Ubiquiti UniFi OS products such as EFG, ENVR, ENVR‑Core, Express 7, UCG‑Fiber, UCG‑Industrial, UCG‑Max, UCG‑Ultra, UCK, UCK‑Enterprise, UCKP, UDM, UDM‑Beast, UDM‑Pro, UDM‑Pro‑Max, UDM‑SE, UDR, UDR‑5G, UDR7, UDW, UNAS‑2, UNAS‑4, UNAS‑Pro, UNAS‑Pro‑4, UNAS‑Pro‑8, UNVR, UNVR‑G2, UNVR‑G2‑Pro, UNVR‑Instant, UNVR‑Pro, and UniFi OS Server. The advisory does not list specific firmware versions; the flaw is present in all firmware builds prior to the vendor’s fix.

The CVSS base score of 7.7 indicates a high risk to confidentiality. No EPSS score is provided, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be an internal or tunnelled network connection to the device’s management interface, where an actor with low privileges crafts a malicious path. Even without publicly known exploits, the potential for sensitive data disclosure makes timely remediation critical.