CVE-2026-55117: Ubiquiti UniFi Access Application path traversal

CVE-2026-55117 · Severity: high · CVSS 8.6 · Published 2026-07-02

Ubiquiti UniFi Access Application, a software suite used to manage physical security and door access systems, contains a vulnerability that allows unauthorized network users to access sensitive files. An attacker could exploit this to read system configuration files or other data stored on the host device. This could lead to the exposure of credentials or other information necessary to compromise the physical security infrastructure.

Technologies: Ubiquiti Inc UniFi Access Application. Vendors: Ubiquiti Inc.

Quick answers

Is CVE-2026-55117 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55117 being exploited in the wild.
How severe is CVE-2026-55117?
High severity, with a CVSS score of 8.6, published 2 July 2026.
Which products and versions are affected?
Ubiquiti Inc UniFi Access Application < 4.2.29.
Is there a fix for CVE-2026-55117?
A patch was published on 2026-07-02: Vulnerability addressed in UniFi Access Application version 4.2.29. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55117 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-55117?
Check whether you run Ubiquiti Inc UniFi Access Application at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability (CWE-22) exists in the Ubiquiti UniFi Access Application prior to version 4.2.29. The flaw allows an unauthenticated attacker with network access to the application to bypass directory restrictions and read arbitrary files on the underlying host operating system. The vulnerability is characterized by a CVSS 3.1 score of 8.6, reflecting high confidentiality impact and a changed scope, as the exploit allows access to files outside of the application's intended web root. Users are advised to update to version 4.2.29 or later to mitigate this risk.

Affected products

  • Ubiquiti Inc UniFi Access Application < 4.2.29

Timeline

  • 2026-07-02: advisory: Initial publication of CVE-2026-55117 and vendor bulletin 066.
  • 2026-07-02: patched: Vulnerability addressed in UniFi Access Application version 4.2.29.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.