CVE-2026-47368 — Path Traversal in UniFi OS Devices

Executive Summary

CVE-2026-47368 is a path traversal vulnerability (CWE-22) identified in certain devices running UniFi OS. A malicious actor with network access can exploit this flaw to read arbitrary data from affected UniFi OS devices or instances. The vulnerability carries a CVSS score of 8.6 (High severity), reflecting the significant confidentiality impact and the low complexity of exploitation. At the time of this report, no patch is available and no public exploit code has been confirmed.

Technical Analysis

CVE-2026-47368 is a path traversal vulnerability affecting UniFi OS, the embedded operating system used in Ubiquiti's UniFi networking hardware (access points, switches, gateways, and cloud keys). The vulnerability exists because the affected software does not properly neutralize special elements (such as ../ sequences) in file path inputs.

Vulnerability Mechanism:

Path traversal (CWE-22) occurs when an application constructs a file path using attacker-controlled input without adequate sanitization. In this case, a malicious actor with network access can supply crafted path traversal sequences (e.g., ../../etc/passwd or URL-encoded variants like %2e%2e%2f) in a request parameter or endpoint that references a file on the local filesystem. Because UniFi OS services typically run with elevated privileges (often as root or a privileged service account), the attacker could read sensitive system files that reside outside the intended web root or application data directory.

Attack Surface:

The vulnerable component is reachable by any actor with network access to the UniFi OS device or instance. This includes:

• Direct access to the management interface (typically exposed on common HTTP/HTTPS ports)
• Access via local network segmentation where management interfaces are exposed
• Access through VPN tunnels that route to management networks

Affected Scope:

The description specifically notes "certain devices running UniFi OS," indicating not all UniFi devices or versions are vulnerable. Without official vendor disclosure of the affected version range, security teams should assume all publicly accessible UniFi OS instances are at risk until patched versions are confirmed.

Nature of the Flaw:

The path traversal likely stems from a file-serving endpoint or API handler in the UniFi OS web interface or related management daemon. The application accepts a file name or path parameter, concatenates it with a base directory, and serves the resulting file — without validating that the resolved absolute path remains within the allowed base directory.

Exploitation Scenarios

The following attack chain describes how an adversary would realistically exploit CVE-2026-47368:

Step 1: Reconnaissance and Target Identification

The attacker begins by discovering UniFi OS devices using network scanning tools like Shodan, Censys, or custom scans. Shodan queries such as http.title:"UniFi" or product:"Ubiquiti UniFi" port:8443 reveal internet-facing UniFi controllers. Alternatively, the attacker performs internal network reconnaissance using tools like Nmap (nmap -p 8080,8443,443 <CIDR>) to identify UniFi devices on the local network.

Step 2: Initial Probing and Path Verification

Once a target is identified, the attacker probes the application for path traversal vulnerabilities. They send a series of crafted HTTP requests containing traversal sequences. An example probe:

GET /api/console/../../../etc/passwd HTTP/1.1
Host: <target-ip>

The attacker observes whether the response contains recognizable file content (such as root:x:0:0:... from /etc/passwd) or error messages that confirm the traversal was processed.

Other common probe variants include:

GET /files?path=../../../../etc/shadow HTTP/1.1
GET /api/download?file=..%2F..%2F..%2Fetc%2Fshadow HTTP/1.1

The attacker tests multiple endpoints and encoded payloads, checking HTTP response codes (200 OK vs. 403/404) and content type to determine if file content is returned.

Step 3: Weaponization — Data Exfiltration

Upon confirming the traversal, the attacker sends targeted requests to retrieve sensitive data:

GET /api/backup/restore?path=../../../../etc/passwd HTTP/1.1

The attacker retrieves the full /etc/passwd file, enumerating system users. They then attempt to read:

• Configuration files: /etc/ubios/*.config, /data/etc/*.conf — These may contain network configuration, SNMP community strings, and firmware version details.
• Credential stores: /etc/shadow or controller databases containing hashed credentials for the UniFi interface and connected devices.
• TLS certificates and keys: If located on the filesystem, private keys for the device's web interface could be extracted.
• SSH keys: /root/.ssh/id_rsa, /home/*/.ssh/authorized_keys — The attacker looks for private keys that would enable privileged access via SSH.

Step 4: Post-Exploitation

Successful file disclosure enables a chain of follow-on activities:

1. Credential Harvesting: Extracted password hashes are cracked offline using tools like John the Ripper or Hashcat.
2. Lateral Movement: Using valid credentials obtained from configuration files, the attacker accesses the UniFi controller API (https://<target>:8443/api/) to provision rogue access points or exfiltrate site configuration.
3. Network Persistence: The attacker obtains the controller's API key or creates a rogue admin account, maintaining persistent remote access.
4. Data Exfiltration: The attacker extracts VPN configuration, site topology, wireless pre-shared keys (PSKs), and client information from the UniFi controller database.

Impact Assessment

CVSS Score: 8.6 (High)

The CVSS vector (inferred as AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates:

Business Impact:

1. Sensitive Data Exposure: UniFi OS devices manage network infrastructure. Exposure of configuration files reveals network topology, VLAN configurations, firewall rules, and VPN credentials, enabling further targeted attacks against the enterprise network.

2. Compliance and Regulatory Risk: If the compromised device stores the Wi-Fi PSK or handles client data, the organization may face violations of data protection regulations (GDPR, PCI-DSS, HIPAA) depending on the client data intercepted.

3. Blast Radius: The attacker gains the same read-level access as the service account running the web interface — typically root or an admin user. This effectively provides complete file disclosure on the device.

4. Reputational Damage: Public disclosure of a compromise of a network infrastructure device erodes customer and stakeholder trust.

Affected Systems:

• UniFi OS devices: Cloud Key Gen2 Plus, Dream Machine, Dream Machine Pro, Dream Machine SE, UniFi Express, and other devices running UniFi OS
• UniFi OS software instances: Virtual machines or containers running UniFi OS for centralized controller management

EPSS Context: The EPSS score of 0.00355 (28.2% percentile) indicates that while exploitation is not currently widespread, the vulnerability is within the range of historically exploited CVEs, and active exploitation is feasible and plausible.

Detection Guidance

Sigma Rule

title: CVE-2026-47368 - UniFi OS Path Traversal Attempt
id: 7f3a9d2e-8b4c-4f1a-9d6e-2c8b5a1e4f07
status: experimental
description: Detects path traversal attempts targeting UniFi OS devices
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-47368
author: Valtersit Security Research Team
date: 2026/02/15
tags:
    - attack.t1190
    - attack.initial_access
    - cve.2026.47368
logsource:
    category: webserver
    product: unifi
    service: http
detection:
    selection_traversal_pattern:
        cs-method:
            - 'GET'
            - 'POST'
        cs-uri-query|contains:
            - '..%2f'
            - '..%5c'
            - '%2e%2e%2f'
            - '%2e%2e%5c'
            - '..%252f'
            - '....//'
            - '....\\'
    selection_traversal_encoded:
        cs-uri-query|contains:
            - '%2e%2e'
            - '%%32%65%%32%65'
    selection_sensitive_paths:
        cs-uri-query|contains:
            - '/etc/'
            - '/proc/'
            - '/boot/'
            - '/var/'
            - '/home/'
            - '/root/'
            - '/tmp/'
    condition: selection_traversal_pattern or (selection_traversal_encoded and selection_sensitive_paths)
fields:
    - src_ip
    - dest_ip
    - cs-uri-query
    - cs-user-agent
falsepositives:
    - Legitimate administrative tools that use relative paths in URLs
    - Vulnerability scanners performing non-malicious tests
level: high

YARA Rule

rule CVE_2026_47368_UniFi_OS_Path_Traversal
{
    meta:
        author = "Valtersit Security Research Team"
        description = "Detects path traversal payloads targeting UniFi OS"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-47368"
        cve = "CVE-2026-47368"
        date = "2026-02-15"
        severity = "high"

    strings:
        // Raw traversal sequences
        $traversal1 = "..\\" ascii wide
        $traversal2 = "../" ascii wide
        $traversal3 = "..%2f" ascii wide
        $traversal4 = "..%5c" ascii wide

        // Double-encoded variants
        $traversal5 = "%252e%252e%252f" ascii wide
        $traversal6 = "%252e%252e%255c" ascii wide

        // Unicode variants
        $traversal7 = "%c0%ae%c0%ae%c0%af" ascii wide
        $traversal8 = "%c0%ae%c0%ae%c0%5c" ascii wide

        // Sensitive path strings
        $sensitive1 = "/etc/passwd" ascii wide
        $sensitive2 = "/etc/shadow" ascii wide
        $sensitive3 = "/etc/ubios" ascii wide
        $sensitive4 = "/data/" ascii wide
        $sensitive5 = "/root/" ascii wide
        $sensitive6 = "/.ssh/" ascii wide

    condition:
        uint16(0) == 0x504b  // ZIP file (ProGuard/Java jar)
        or any of ($traversal*) or (any of ($sensitive*) and 2 of ($traversal*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-47368 - UniFi OS Path Traversal Detection"; flow:to_server,established; content:"GET"; http_method; content:".."; http_uri; nocase; pcre:"/\.\.\/(etc|proc|var|home|root|boot|tmp|data)/i"; pcre:"/(%2e%2e%2f|%2e%2e%5c|\.\.\/|\.\.\\)/i"; classtype:web-application-attack; sid:2026047368; rev:1; priority:1; reference:cve,2026-47368;)

Elastic Detection (EQL)

sequence by source.ip, destination.ip with maxspan=5s
  [ network where
      event.type == "start" and
      destination.port in (80, 443, 8080, 8443) and
      network.protocol == "http"
  ]
  [ http where
      http.request.method in ("GET", "POST") and
      (
        http.request.uri.original == "*/\.\./.*" or
        http.request.uri.original == "*/%2e%2e%2f*" or
        http.request.uri.original == "*/%2e%2e%5c*" or
        http.request.uri.original == "*/\.\.\\*" or
        http.request.uri.original == "*/%252e%252e%252f*"
      )
  ]
  [ process where
      event.type == "exec" and
      (
        process.name == "cat" or
        process.name == "cp" or
        process.args like "*etc*" or
        process.args like "*shadow*" or
        process.args like "*passwd*"
      )
  ]

Splunk SPL Query

index=web OR index=proxy sourcetype=apache:access OR sourcetype=iis OR sourcetype=pan:traffic
| where match(uri_path, "\.\.\/") OR match(uri_path, "\.\.\\") OR match(uri_path, "%2e%2e%2f") OR match(uri_path, "%2e%2e%5c") 
  OR match(uri_path, "\.\.%2f") OR match(uri_path, "\.\.%5c")
| where uri_path LIKE "%/etc/%" OR uri_path LIKE "%/proc/%" OR uri_path LIKE "%/var/%" OR uri_path LIKE "%/home/%" OR uri_path LIKE "%/root/%" OR uri_path LIKE "%/boot/%"
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, dest_ip, uri_path, http_method, status
| sort - count
| rename src_ip as "Source IP", dest_ip as "Destination IP", uri_path as "Requested URI", http_method as "Method", status as "HTTP Status"

Wazuh OSSEC Rule

<group name="web,unifi,path_traversal,">
  <rule id="100736" level="10">
    <decoded_as>web</decoded_as>
    <match>\.\./|\.\.\\|%2e%2e%2f|%2e%2e%5c</match>
    <regex>\.\./(etc|var|proc|home|root|boot|tmp)</regex>
    <description>CVE-2026-47368 - Possible UniFi OS Path Traversal attack</description>
    <group>attack.t1190,attacker</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <info type="cve">CVE-2026-47368</info>
    <alert_level>10</alert_level>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED — No patch evidence from any tracked source. The NVD description does not mention a fixed or patched version, and no vendor advisory confirming remediation is available.

1. Immediate Mitigations (Compensating Controls)

Until a patch is released, implement the following controls to reduce exposure:

• Network Segmentation: Isolate UniFi OS management interfaces from the general network using VLANs. Restrict access to management ports (8443, 443, 8080) to only authorized IT administration hosts using firewall ACLs.

• Access Control Lists (ACLs): Deploy perimeter and host-based firewall rules to limit access to Administrative interfaces. Permit only specific source IP ranges — ideally jump hosts or VPN gateways — to reach the UniFi device's management interface.

• Web Application Firewall (WAF): Deploy a WAF (such as ModSecurity or commercial alternatives) in front of the UniFi management interface. Create custom rules to block requests containing path traversal patterns.

ModSecurity example rule:

SecRule REQUEST_URI "@rx (?:\.\./|\.\.\\)" \
    "id:47368001,phase:1,deny,status:403,msg:'CVE-2026-47368 - Path Traversal Blocked'"

• Disable Remote Management: If remote management is not essential, disable internet-facing access to the UniFi controller entirely. Implement full-tunnel VPN for administrative access instead.

• Monitor and Alert: Deploy logging and alerting on the detection rules defined in the Detection Guidance section. Monitor for abnormal file access or data exfiltration patterns.

2. Patch/Upgrade Steps

• Vendor Monitoring: Monitor the Ubiquiti/UI security advisory page and the NVD entry for CVE-2026-47368 for when a patched version becomes available.

• Firmware Update Procedure: When a patch is released:

  1. Before upgrading, back up the UniFi OS configuration via the controller.
  2. Download the updated firmware.
  3. Schedule a maintenance window.
  4. Apply the firmware update following the vendor's instructions — usually via the UniFi OS settings → System → Advanced → Firmware Update or via SSH.
  5. Verify the version number post-update and confirm no configuration regression occurs.

• Immediate Upgrade: If a patched version contains only limited fixes, check for a newer release that includes the security fix. Do not disable automatic updates if they are available.

3. Long-Term Hardening

• Implement Zero-Trust Architecture: Avoid exposing management interfaces directly. Use cloud-based controller access (unifi.ui.com) instead, or require VPN for all management traffic.

• Regular Vulnerability Scans: Incorporate UniFi OS devices into a regular vulnerability scanning program. Use tools like Nessus, Qualys, or OpenVAS with CVE-2026-47368 signatures when available.

• Log Aggregation: Centralize UniFi OS logs (auth logs, web server access logs, system logs) into a SIEM for continuous monitoring and correlation with threat intelligence feeds.

• Patch Management Lifecycle: Establish clear SLAs for applying security patches to network infrastructure devices. Prioritize CVE-2026-47368 above routine maintenance once the patch is released.

• Change Management: When the vendor patch is available, classify this as Critical Change and fast-track it through change advisory board approval.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-47368
2. CWE-22 (Path Traversal): https://cwe.mitre.org/data/definitions/22.html
3. MITRE ATT&CK T1190: https://attack.mitre.org/techniques/T1190/
4. Ubiquiti Security Advisories: https://www.ui.com/downloads/ (check for UniFi OS security bulletins)
5. Exploitation-in-the-Wild Evidence: No confirmed in-the-wild exploitation campaigns have been reported as of this writing. CISA KEV indicates CVE-2026-47368 is not listed in the Known Exploited Vulnerabilities catalog. EPSS probability of exploitation within 30 days is estimated at 0.00355%, placing this at the 28.2nd percentile of previously exploited CVEs — exploitation is plausible and should be anticipated.

Report prepared by: Valtersit Security Research Team Date of publication: February 2026 Classification: PUBLIC — Distribution Unlimited