CVE record · CVE-2026-47368

Path traversal in Ubiquiti Inc UniFi OS Server and others

CVSS 8.6 HighEPSS 0.0036 · 29th percentile

Published by the CVE Program (CNA: hackerone) at 12 Jun 2026, 02:27 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
Vendor	Product	Versions
Ubiquiti Inc	UniFi OS Server	affected before 5.1.15 semver Other versions: unaffected
Ubiquiti Inc	Express	affected before 4.0.15 semver Other versions: unaffected
Ubiquiti Inc	UDM	affected before 5.1.15 semver Other versions: unaffected
Ubiquiti Inc	UDM-Pro	affected before 5.1.15 semver Other versions: unaffected
Ubiquiti Inc	UDM-SE	affected before 5.1.15 semver Other versions: unaffected
Ubiquiti Inc	UDM-Pro-Max	affected before 5.1.15 semver Other versions: unaffected
Ubiquiti Inc	UDM-Beast	affected before 5.1.15 semver Other versions: unaffected
Ubiquiti Inc	EFG	affected before 5.1.15 semver Other versions: unaffected
Ubiquiti Inc	UDW	affected before 5.1.15 semver Other versions: unaffected
Ubiquiti Inc	UDR	affected before 5.1.15 semver Other versions: unaffected
Ubiquiti Inc	UDR7	affected before 5.1.15 semver Other versions: unaffected
Ubiquiti Inc	UDR-5G	affected before 5.1.15 semver Other versions: unaffected
Ubiquiti Inc	Express 7	affected before 5.1.15 semver Other versions: unaffected
Ubiquiti Inc	UNVR	affected before 5.1.15 semver Other versions: unaffected
Ubiquiti Inc	UNVR-Pro	affected before 5.1.15 semver Other versions: unaffected
Ubiquiti Inc	UNVR-Instant	affected before 5.1.15 semver Other versions: unaffected
Ubiquiti Inc	UNVR-G2	affected before 5.1.15 semver Other versions: unaffected
Ubiquiti Inc	UNVR-G2-Pro	affected before 5.1.15 semver Other versions: unaffected
Ubiquiti Inc	ENVR	affected before 5.1.15 semver Other versions: unaffected
Ubiquiti Inc	ENVR-Core	affected before 5.1.15 semver Other versions: unaffected
Ubiquiti Inc	UNAS-2	affected before 5.1.16 semver Other versions: unaffected
Ubiquiti Inc	UNAS-4	affected before 5.1.16 semver Other versions: unaffected
Ubiquiti Inc	UNAS-Pro	affected before 5.1.16 semver Other versions: unaffected
Ubiquiti Inc	UNAS-Pro-4	affected before 5.1.16 semver Other versions: unaffected
Ubiquiti Inc	UNAS-Pro-8	affected before 5.1.16 semver Other versions: unaffected
Ubiquiti Inc	UCKP	affected before 5.1.15 semver Other versions: unaffected
Ubiquiti Inc	UCK	affected before 5.1.15 semver Other versions: unaffected
Ubiquiti Inc	UCK-Enterprise	affected before 5.1.15 semver Other versions: unaffected
Ubiquiti Inc	UCG-Ultra	affected before 5.1.15 semver Other versions: unaffected
Ubiquiti Inc	UCG-Max	affected before 5.1.15 semver Other versions: unaffected
Ubiquiti Inc	UCG-Fiber	affected before 5.1.15 semver Other versions: unaffected
Ubiquiti Inc	UCG-Industrial	affected before 5.1.15 semver Other versions: unaffected

Identifiers: CVE-2026-47368
CNA: hackerone
Weakness (CWE): CWE-22
Tags: Ubiquiti Inc UniFi OS Server
Ubiquiti Inc Express
Ubiquiti Inc UDM
Ubiquiti Inc UDM-Pro
Ubiquiti Inc UDM-SE
Ubiquiti Inc UDM-Pro-Max
Ubiquiti Inc UDM-Beast
Ubiquiti Inc EFG
Path traversal
Published: 12 Jun 2026
Updated: 12 Jun 2026

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

Score	Rating	CVSS	Vector	Source
8.6	High	3.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N	CNA (hackerone)

CISA KEV Not listed.
EPSS 0.0036, the 29th percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 12 Jun 2026. New records show when each source confirmed them.

Sources

References from the CNA

community.ui.com/releases/Security-Advisory-Bulletin-065-065/aa46a22b-fc43-4eae-9382-6fc8feda967a

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.