CVE-2026-34911

HighCVSS 7.7/10Last modified Jul 23, 2026

Description

A malicious actor with access to the network and low privileges could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to obtain sensitive information.

Metrics

CVSS 3.1 7.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
Ubiquiti Inc	UniFi OS Server	< 5.0.8
Ubiquiti Inc	UDM	< 5.1.12
Ubiquiti Inc	UDM-Pro	< 5.1.12
Ubiquiti Inc	UDM-SE	< 5.1.12
Ubiquiti Inc	UDM-Pro-Max	< 5.1.12
Ubiquiti Inc	UDM-Beast	< 5.1.11
Ubiquiti Inc	EFG	< 5.1.12
Ubiquiti Inc	UDW	< 5.1.12
Ubiquiti Inc	UDR	< 5.1.12
Ubiquiti Inc	UDR7	< 5.1.12
Ubiquiti Inc	UDR-5G	< 5.1.12
Ubiquiti Inc	Express 7	< 5.1.12
Ubiquiti Inc	UNVR	< 5.1.12
Ubiquiti Inc	UNVR-Pro	< 5.1.12
Ubiquiti Inc	UNVR-Instant	< 5.1.12
Ubiquiti Inc	UNVR-G2	< 5.1.12
Ubiquiti Inc	UNVR-G2-Pro	< 5.1.12
Ubiquiti Inc	ENVR	< 5.1.12
Ubiquiti Inc	ENVR-Core	< 5.1.12
Ubiquiti Inc	UNAS-2	< 5.1.10
Ubiquiti Inc	UNAS-4	< 5.1.10
Ubiquiti Inc	UNAS-Pro	< 5.1.10
Ubiquiti Inc	UNAS-Pro-4	< 5.1.10
Ubiquiti Inc	UNAS-Pro-8	< 5.1.10
Ubiquiti Inc	UCKP	< 5.1.12
Ubiquiti Inc	UCK	< 5.1.12
Ubiquiti Inc	UCK-Enterprise	< 5.1.12
Ubiquiti Inc	UCG-Ultra	< 5.1.12
Ubiquiti Inc	UCG-Max	< 5.1.12
Ubiquiti Inc	UCG-Fiber	< 5.1.12
Ubiquiti Inc	UCG-Industrial	< 5.1.12

References

https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963bPatch, Vendor Advisory

Timeline

Published: May 22, 2026
Last modified: Jul 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-349124.3A missing access control check when linking banners or campaigns to a zone through the zone-include.php script of Revive Adserver 6.0.6 and CVE-2026-349134.3A missing access control check when linking trackers to campaigns through the campaign-trackers.php script of Revive Adserver 6.0.6 and earl CVE-2026-349148.3A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and earlier. A low‑privileged user could exploi CVE-2026-349156.1A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and earlier could allow a low‑privileged user t CVE-2026-349168.8A missing validation of user input when saving delivery limitations in Revive Adserver 6.0.6 and earlier could allow a low‑privileged user t CVE-2026-349174.3Low‑privileged session IDs generated for the web admin console could be reused in the XML‑RPC API, whose authentication is normally restrict CVE-2026-34926.4The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.9.28.1. This is CVE-2026-349266.7A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table CVE-2026-349277.8An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. CVE-2026-349287.8An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. CVE-2026-349297.8An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. CVE-2026-349307.8An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations.