Loading vulnerability…
Path Traversal in UniFi Access Application
CVE-2026-55117 is a high-severity path traversal vulnerability in UniFi Access Application affecting version 4.2.28 and earlier. A malicious actor with network access can exploit improper restriction of pathname resolution to traverse directories and access files on the underlying host device outside the intended scope of the application. The issue is remotely exploitable and results in unauthorized access to host-resident files exposed through the vulnerable application logic.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows unauthorized access to files on the host device, resulting in compromise of sensitive information stored or reachable by the application. Available scoring metadata indicates high confidentiality impact, and associated reporting also indicates potential integrity and availability impact on the affected host depending on what files can be reached and how the accessed data is subsequently abused.
If you can’t patch tonight, do this now.
If immediate patching is not possible, restrict network access to the UniFi Access Application to only trusted administrative or management networks, minimize exposure to untrusted adjacent networks, and closely monitor the host file system and application activity for suspicious access patterns. These measures reduce exposure but do not eliminate the underlying flaw.
Patch, then assume compromise.
Upgrade UniFi Access Application to version 4.2.29 or later, which contains the vendor fix for this vulnerability. Because no interim workaround is indicated, applying the patched release is the primary remediation action.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.