A malicious actor with network access and high privileges can exploit a Path Traversal flaw in self‑hosted instances of the UniFi Network Application, allowing the attacker to write arbitrary files to the host operating system. The vulnerability, mapped to CWE‑22, compromises file integrity and may further compromise system resources. It does not directly grant arbitrary code execution, but the ability to write files creates a strong foothold for additional attacks.

All self‑hosted installations of the UniFi Network Application from Ubiquiti Inc. are affected. No specific version range is provided by the vendor, so any deployment that has not applied the vendor’s fix may be vulnerable. Verify the installed version against Ubiquiti’s release notes for remediation details.

The CVSS score of 8.7 indicates a serious vulnerability, while the EPSS score of less than 1% suggests that widespread exploitation has not yet been observed. Attackers need network connectivity to the controller and sufficient privileges to submit a crafted request. Successful exploitation results in write access to the host, compromising system integrity and potentially enabling further attacks. The vulnerability is not listed in the CISA KEV catalog.