{"id":"CVE-2026-22557","aliases":["EUVD-2026-13101","GHSA-vgw4-7v5q-w7f7"],"status":"published","title":"A malicious actor with access to the network could exploit a Path Traversal vulnerability found...","description":"A malicious actor with access to the network could exploit a Path Traversal vulnerability found in the UniFi Network Application to access files on the underlying system that could be manipulated to access an underlying account.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.28665,"percentile":0.98165,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-22"],"published":"2026-03-19T14:24:51Z","modified":"2026-06-17T10:20:04Z","exploits":[{"source":"pocgithub","id":"GarethMSheldon/cve-2026-22557-unifi-detection","title":"GarethMSheldon/cve-2026-22557-unifi-detection","date":"2026-03-22","url":"https://github.com/GarethMSheldon/cve-2026-22557-unifi-detection"},{"source":"pocgithub","id":"ashrafzaryouh/CVE-2026-22557","title":"ashrafzaryouh/CVE-2026-22557","date":"2026-04-05","url":"https://github.com/ashrafzaryouh/CVE-2026-22557"},{"source":"pocgithub","id":"ThePotatoOfDoom/CVE-2026-22557-PoC","title":"ThePotatoOfDoom/CVE-2026-22557-PoC","date":"2026-04-11","url":"https://github.com/ThePotatoOfDoom/CVE-2026-22557-PoC"},{"source":"pocgithub","id":"BishopFox/CVE-2026-22557-check","title":"BishopFox/CVE-2026-22557-check","date":"2026-05-29","url":"https://github.com/BishopFox/CVE-2026-22557-check"},{"source":"pocgithub","id":"gagaltotal/CVE-2026-22557-Path-Traversal-Ubiquti-UniFi","title":"gagaltotal/CVE-2026-22557-Path-Traversal-Ubiquti-UniFi","date":"2026-06-30","url":"https://github.com/gagaltotal/CVE-2026-22557-Path-Traversal-Ubiquti-UniFi"},{"source":"nuclei","id":"CVE-2026-22557","title":"UniFi Network Application - Path Traversal","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-22557.yaml"}],"products":[{"vendor":"ubiquiti inc","product":"unifi network application"}],"references":[{"url":"https://community.ui.com/releases/Security-Advisory-Bulletin-062-062/c29719c0-405e-4d4a-8f26-e343e99f931b"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22557"},{"url":"https://github.com/advisories/GHSA-vgw4-7v5q-w7f7"}],"sources":{"cve":[{"id":"CVE-2026-22557","description":"A malicious actor with access to the network could exploit a Path Traversal vulnerability found in the UniFi Network Application to access files on the underlying system that could be manipulated to access an underlying account.","status":"published","published":"2026-03-19T14:24:51.91Z","modified":"2026-03-19T15:03:43.144Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T13:39:05.585774Z"}],"euvd":[{"id":"EUVD-2026-13101","description":"A malicious actor with access to the network could exploit a Path Traversal vulnerability found in the UniFi Network Application to access files on the underlying system that could be manipulated to access an underlying account.","status":"published","published":"2026-03-19T14:24:51Z","modified":"2026-03-19T15:03:43Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:25:32.813864Z"}],"ghsa":[{"id":"GHSA-vgw4-7v5q-w7f7","title":"A malicious actor with access to the network could exploit a Path Traversal vulnerability found...","description":"A malicious actor with access to the network could exploit a Path Traversal vulnerability found in the UniFi Network Application to access files on the underlying system that could be manipulated to access an underlying account.","status":"published","published":"2026-03-19T15:31:21Z","modified":"2026-03-19T15:31:22Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:06:42.889562Z"}],"nvd":[{"id":"CVE-2026-22557","description":"A malicious actor with access to the network could exploit a Path Traversal vulnerability found in the UniFi Network Application to access files on the underlying system that could be manipulated to access an underlying account.","status":"published","published":"2026-03-19T15:16:23.533Z","modified":"2026-06-17T10:20:04.583Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:12:09.735529Z"}]}}