Executive brief
UnPoller is a monitoring tool that collects data from UniFi network controllers and exports metrics to time-series databases like InfluxDB. The application accepts file:// URLs in credential fields to load passwords from disk files, but does not validate the file path. An attacker with write access to UnPoller's configuration file can modify it to read any file the UnPoller process can access and exfiltrate the contents over the network to a server under their control, potentially exposing sensitive system files, application secrets, or key material.
Technical details
This is a path traversal vulnerability in UnPoller's credential loading mechanism. When the password or API key field in the configuration file starts with file://, UnPoller strips the prefix and uses os.ReadFile() to load the file without any path validation or whitelist. The file contents are then transmitted over the network in a JSON POST request to the configured UniFi controller URL during authentication. An attacker with write access to the UnPoller config file (up.conf) can modify both the file:// path and the controller URL to point to an attacker-controlled server, creating a reliable exfiltration channel for arbitrary readable files on the host (e.g., /etc/passwd, application configs, environment data). This affects UnPoller 2.33.0 and likely earlier versions; no patch is currently known to be available.
Affected products
- UnPoller UnPoller 2.33.0 and likely earlier
Timeline
- 2026-08-26: disclosed: Public disclosure on GitHub with working PoC
- 2026: other: CVE-2026-36851 assigned