CVE-2026-54406

HighCVSS 8.7/10Last modified Jul 6, 2026

Description

A malicious actor with access to the network and high privileges could exploit a Path Traversal vulnerability found in self-hosted instances of UniFi Network Application to escalate write permission on the host device.

Metrics

CVSS 3.1 8.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Jul 2, 2026
Last modified
Jul 6, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-544078.6A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect Application to byCVE-2026-544089.8A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect Application to byCVE-2026-544098.1A malicious actor with access to the network and under certain conditions could exploit an Improper Initialization vulnerability found in UnCVE-2026-54417.1An out-of-bounds read vulnerability exists in the `DecodePsmctRle1` function of `DicomImageDecoder.cpp`. The `PMSCT_RLE1` decompression routCVE-2026-544108.6nanoMODBUS through v1.23.0 contains an off-by-one buffer overflow in the recv_msg_header function of the Modbus/TCP server that allows remotCVE-2026-544115.9Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path inCVE-2026-544128.2LiamBindle MQTT-C through version 1.1.6 contains a heap-based out-of-bounds read and integer underflow in the mqtt_unpack_publish_response fCVE-2026-544138.2driftregion iso14229 through 0.9.0 contains an integer underflow and downstream out-of-bounds read in the Handle_0x27_SecurityAccess functioCVE-2026-544149.8FileRise before 3.16.0 is vulnerable to path traversal in the shared-folder upload endpoint (/api/folder/uploadToSharedFolder.php), leading CVE-2026-544158.1Missing Authorization in the server management routes (routes/admin.php) in Azuriom Azuriom CMS before 1.2.11 on all platforms allows an autCVE-2026-544167.2Pluck CMS through 4.7.21 restricts dangerous file uploads in its admin file-management feature using a fixed blacklist in data/inc/files.phpCVE-2026-544177.5An integer overflow in the mtar_next function in src/microtar.c in rxi microtar 0.1.0 allows a remote attacker to cause a denial of service