Read the docs
TI-2026-18125 Aliases CVE-2026-22557GHSA-vgw4-7v5q-w7f7

Path traversal in Ubiquiti UniFi Network Application

Priority HIGH 72CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

A malicious actor with access to the network could exploit a Path Traversal vulnerability found in the UniFi Network Application to access files on the underlying system that could be manipulated to access an underlying account.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.28665 98th percentileScored 2026-11-07
Fix Fixed UniFi Network Application (Ubiquiti Inc): 10.1.89, 10.2.97, 9.0.118

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UbiquitiUniFi Network Application10.1.89 to before 10.1.89; 10.2.97 to before 10.2.97; 9.0.118 to before 9.0.11810.1.89, 10.2.97, 9.0.118Patch availableCNA
  • UniFi Network Application VendorUbiquiti Affected 10.1.89 to before 10.1.89; 10.2.97 to before 10.2.97; 9.0.118 to before 9.0.118 Fixed in 10.1.89, 10.2.97, 9.0.118 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:ui:unifi_network_application:*:*:*:*:*:*:*:*——Ubiquiti
  • cpe:2.3:a:ui:unifi_network_application:*:*:*:*:*:*:*:* Versions — — ·Ubiquiti

Remediation

  • Fix · CNA UniFi Network Application (Ubiquiti Inc) Fixed in 10.1.89, 10.2.97, 9.0.118

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Ubiquiti UniFi Network Application 10.1.89, 10.2.97, 9.0.118

    2 records Highest priority Priority HIGH 1 HIGH, 1 LOW

    Other records, highest priority first

    • TI-2026-18126 An Authenticated NoSQL Injection vulnerability found in UniFi Network Application could…Priority LOW 34
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-22557
  2. 2026-10-03 Alias added: GHSA-vgw4-7v5q-w7f7

References

Other 1

  • TI-2026-27142 Improper input validation in Ubiquiti UniFi OS Server KEVCVSS 3.1CRITICAL 10.0
  • TI-2026-27141 Path traversal in Ubiquiti UniFi OS Server KEVCVSS 3.1CRITICAL 10.0
  • TI-2026-27140 Improper access control in Ubiquiti UniFi OS Server KEVCVSS 3.1CRITICAL 10.0
  • TI-2010-05027 On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi… KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-19187 AirControl 1.4.2 - PreAuth Remote Code Execution CVSS 4.0CRITICAL 9.3
  • TI-2015-07644 Ubiquiti airOS HTTP(S) unauthenticated arbitrary file upload CVSS 3.0CRITICAL 9.8
See all 206 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences