Quick Look: CVE-2026-34911 Path Traversal in Ubiquiti UniFi OS Devices

Introduction

A path traversal vulnerability in Ubiquiti's UniFi OS firmware lets a low-privileged attacker on the local network read arbitrary files from the underlying operating system of any affected console or gateway. Many organizations run UniFi Dream Machines, Cloud Keys, NVRs, or one of the dozens of other UniFi OS-powered devices as their central network management plane. For them, this flaw exposed configuration data, credential stores, and other sensitive system files to anyone with basic authenticated access.

Ubiquiti Inc. is an American technology company founded in 2003. It develops a broad portfolio of networking hardware and software, including access points, routers, switches, cameras, and physical access control devices. These products are managed centrally through UniFi OS, a proprietary operating system that runs on dedicated consoles and is the single management interface for entire network deployments. UniFi is widely adopted by small and medium businesses, managed service providers, and prosumers. Because UniFi OS controls so many devices and networks, a vulnerability in it has a wide reach.

Technical Information

CVE-2026-34911 is a Path Traversal vulnerability classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The flaw is in UniFi OS, the firmware operating system that runs on Ubiquiti's console and gateway hardware. An authenticated user can craft requests that escape the web interface's intended directory boundaries and read files on the underlying Linux-based operating system.

Preconditions

Exploitation requires two conditions:

1. The attacker can reach the UniFi OS device over the network. This usually means being on the same LAN segment, but a device with its management interface exposed to the internet is also reachable.
2. The attacker holds some level of authenticated access to the UniFi OS device. The advisory specifies "low privileges," but the public materials do not say which role or permission level is required.

Attack Flow

The advisory description and the behavior changes in the patched firmware point to this general exploitation pattern:

1. The attacker authenticates to the UniFi OS management interface with a low-privilege account.
2. The attacker crafts a request containing directory traversal sequences. Community analysis of the patch suggests that URL-encoded forward slashes (%2F) are central to the technique, because the patched firmware specifically scans for %2F patterns in stored parameter data.
3. The traversal lets the attacker escape the restricted web root and access files on the underlying system.
4. The accessed files could include configuration data, credential material, or other sensitive information that an attacker could use for further attacks such as privilege escalation or lateral movement.

What the Patch Reveals

The exact vulnerable endpoint is not publicly documented, but the patched firmware (version 5.1.12 for most devices) gives some clues about the flaw. Community analysis found that the updated OS adds a new MongoDB startup query that scans parameter fields for URL-encoded path traversal sequences. It searches for the %2F pattern (URL-encoded forward slash) in parameters such as parameters.ADMIN.name. The scan runs at boot as a built-in indicator-of-compromise (IoC) check and flags any stored data that may have been injected through the traversal bug before the patch was applied.

This suggests the bug went beyond reading files, and that traversal payloads may have been injected into stored parameters, possibly through the management API or configuration interface. That the IoC check targets parameters.ADMIN.name specifically hints that the attack vector intersected with administrative account data.

Information Gaps

Current public sources and vendor advisories do not disclose the specific HTTP request patterns, the exact vulnerable endpoints in the UniFi OS interface, or the low-privilege roles required to trigger the traversal. No proof-of-concept exploit code has been published.

Patch Information

Ubiquiti fixed CVE-2026-34911 with firmware updates across the entire UniFi OS device family, documented in Security Advisory Bulletin 064, published on May 21, 2026. Hakai Security reported the vulnerability through Ubiquiti's HackerOne bug bounty program.

UniFi OS is closed-source firmware, so there are no public code commits or diffs. The fix ships only as firmware upgrades.

The fixed firmware versions vary by device category:

Firmware updates are available from the official Ubiquiti downloads portal.

The MongoDB startup query described in the Technical Information section, which scans stored parameter fields for %2F patterns, also works as a post-exploitation IoC check. Administrators who have applied the patch should watch boot logs for anything it flags. Community discussion also recommends reviewing access logs for path traversal indicators like ..%2F to find out whether a device was compromised before patching.

Affected Systems and Versions

The following UniFi OS device families are affected. All versions prior to the listed patched version are vulnerable:

UniFi OS Consoles and Gateways (patched in 5.1.12):

• UniFi Dream Machine (UDM)
• UniFi Dream Machine Pro (UDM Pro)
• UniFi Dream Machine SE (UDM SE)
• UniFi Dream Machine Pro Max (UDM Pro Max)
• UniFi Dream Router (UDR)
• UniFi Dream Router 7 (UDR7)
• UniFi Dream Router 5G (UDR 5G)
• UniFi Dream Wall (UDW)
• UniFi Express 7
• UniFi Cloud Gateway Ultra (UCG Ultra)
• UniFi Cloud Gateway Max (UCG Max)
• UniFi Cloud Gateway Fiber (UCG Fiber)
• UniFi Cloud Gateway Industrial (UCG Industrial)
• UniFi Cloud Key Gen2 Plus (UCKP)
• UniFi Cloud Key (UCK)
• UniFi Cloud Key Enterprise (UCK Enterprise)
• UniFi NVR (UNVR)
• UniFi NVR Pro (UNVR Pro)
• UniFi NVR Instant (UNVR Instant)
• UniFi NVR G2 (UNVR G2)
• UniFi NVR G2 Pro (UNVR G2 Pro)
• ENVR
• ENVR Core
• EFG

UniFi OS Server, Self Hosted (patched in 5.0.8):

• Versions 5.0.6 and earlier

Network Attached Storage (patched in 5.1.10):

• UNAS 2, UNAS 4, UNAS Pro, UNAS Pro 4, UNAS Pro 8
• Versions 5.1.8 and earlier

UDM Beast (patched in 5.1.11):

• Versions 5.1.8 and earlier

Vendor Security History

Ubiquiti has faced several high-severity vulnerabilities in its software in 2026 alone. In March and May 2026, it patched two serious flaws in the UniFi Network application:

• CVE-2026-22557: A maximum-severity (CVSS 10.0) path traversal vulnerability that allowed network attackers to access system files and potentially take over user accounts.
• CVE-2026-22558: A CVSS 7.7 Authenticated NoSQL Injection vulnerability enabling privilege escalation.

CVE-2026-34911 is the third high-severity or critical vulnerability in the UniFi ecosystem within a few months, and the second path traversal issue. Given these recurring input validation failures in the UniFi software stack, teams running UniFi should keep a strict patching schedule and follow Ubiquiti's security advisories closely.

References

• Ubiquiti Security Advisory Bulletin 064
• Security Advisory Bulletin 064 Community Discussion
• NVD Entry for CVE-2026-34911
• CVE Record for CVE-2026-34911
• UniFi OS Express 7 5.1.12 Release Notes
• Ubiquiti Firmware Downloads
• Security Affairs: Critical Ubiquiti UniFi Security Flaw
• Ubiquiti on Wikipedia