A path traversal vulnerability in Ubiquiti UniFi OS devices allows low-privileged network users to read arbitrary system files, potentially leading to information disclosure.

The vulnerability is a path traversal (CWE-22) flaw that allows an attacker with low privileges to manipulate file paths to access unauthorized system files. The attacker must have network access to the device.

With a CVSS score of 7.7, this vulnerability presents a significant risk to the confidentiality of the network infrastructure. Access to sensitive configuration files or system data could allow an attacker to extract credentials or other information needed to further compromise the network. This could lead to a total loss of confidentiality for the impacted management platform.

Immediate Action: Update all UniFi OS devices and servers to the specified patched versions (5.0.8 for Server, 5.1.12 for UDM/Pro/SE/Max, and 5.1.11 for UDM-Beast) immediately.

Proactive Monitoring: Monitor network traffic to UniFi management interfaces for suspicious HTTP requests containing directory traversal sequences (e.g., "../").

Compensating Controls: Restrict access to the UniFi management interface to trusted administrative subnets only, effectively removing the "low-privileged" network access required for exploitation.

Public Exploit Available: No (exploit_available: false)

The severity of this flaw necessitates immediate attention. Organizations should verify their current firmware versions and apply the patches provided by Ubiquiti without delay to prevent unauthorized file access and potential credential theft.