Ubiquiti Inc. · Report #329770
UniFi Video Server web interface Configuration Restore path traversal leading to local system compromise
Validstatus
criticalseverity
11upvotes
2 Jul 2018disclosed
Summary
In UniFi Video Controller 3.9.3 and prior, an user with administrator privileges can restore the configuration using a specially crafted zip file. Due to the lack of validation for path transversal, the user can upload arbitrary files to arbitrary locations.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.