This vulnerability (CVE-2026-34909) involves a Path Traversal flaw (CWE-22) in the UniFi OS Server by Ubiquiti Inc. An attacker with network access can exploit this flaw to access files outside the intended directory scope on the underlying system. Such unauthorized file access could be leveraged to manipulate system files or gain access to accounts, resulting in complete compromise of the system's confidentiality, integrity, and availability. The CVSS 3.1 base score is 10.0, reflecting the critical nature of the vulnerability with network attack vector, no privileges or user interaction required, and full impact on confidentiality, integrity, and availability. The vendor has not published any patch or official remediation at this time.

Successful exploitation allows an unauthenticated attacker on the network to perform arbitrary file access on the UniFi OS Server system. This can lead to unauthorized disclosure of sensitive information, modification of system files, and disruption of service. The impact is rated critical with full compromise of confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to UniFi OS Server devices to trusted users only and monitor for suspicious activity. Avoid exposing the affected systems to untrusted networks.