A malicious actor with network access and high privileges can exploit a path traversal flaw (CWE‑22) in the self‑hosted UniFi Network Application to write arbitrary files on the host. By submitting a crafted file path, the attacker can create or overwrite files, thereby compromising the integrity of the operating system. The vulnerability grants the attacker write access on the host, which may enable further malicious activity, but the CVE description does not confirm arbitrary code execution.

All self‑hosted installations of the UniFi Network Application from Ubiquiti Inc. are affected. No specific version range is provided by the vendor, so any deployment that has not yet applied a vendor fix may be vulnerable. Verify your installation against Ubiquiti’s release notes for remediation details.

The high CVSS score of 8.7 signals a serious vulnerability. The EPSS score of less than 1% indicates that exploitation has not yet been widely observed. Attackers need network connectivity to the UniFi controller and sufficient privileges to submit a crafted request to trigger the path traversal. Successful exploitation results in the attacker obtaining the ability to write arbitrary files to the host operating system, which can compromise system integrity and may facilitate later attacks. The vulnerability is not listed in the CISA KEV catalog.