Loading vulnerability…
Path Traversal in UniFi Protect Floodlight
CVE-2026-55111 is a path traversal vulnerability affecting UniFi Protect Floodlight devices running version 1.13.4 and earlier. A malicious actor with network access can exploit the flaw to traverse directories and access files stored on the device outside the intended resource scope. The available information identifies the issue as a file access weakness in the Floodlight device software but does not provide the specific vulnerable function or request handler.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an attacker with network access to read files on the UniFi Protect Floodlight device. This can compromise the confidentiality of device-resident data and may expose sensitive configuration or operational information stored on the appliance.
If you can’t patch tonight, do this now.
No interim workaround information is currently available. The primary mitigation is to apply the vendor-provided update immediately and restrict network access to the device to only trusted management networks until patching is completed.
Patch, then assume compromise.
Upgrade UniFi Protect Floodlight to version 1.13.6 or later, which contains the vendor's fix for CVE-2026-55111.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.