gagaltotal/CVE-2026-22557-Path-Traversal-Ubiquti-UniFi

GitHubRepository PoCScanner

PoC files

6 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Go-based scanner that sends path traversal payloads to UniFi Network Application endpoints and reports responses containing system file content indicators without exploiting the vulnerability.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README and a single Go source file implementing a path traversal scanner for CVE-2026-22557. The code performs only the advertised scanning behavior: it constructs HTTP requests with traversal payloads, sends them to a user-supplied target, and reports responses. No hidden, deceptive, or operator-directed harmful behavior is present. The code does not establish persistence, exfiltrate data, download or execute unrelated payloads, or conceal any malicious functionality.

ClassificationScanner
Model confidence98%
AuthenticationNot required
Languagesgo
Target softwareUniFi Network Application
Attack typespath traversal
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The code only sends HTTP requests and inspects responses for indicators of path traversal; it does not write files, execute commands, or establish a foothold. The README explicitly describes it as a 'proof-of-concept scanner' that 'perform[s] a controlled and non-destructive scan' and 'run[s] in a safe, informational mode without modifying target systems'.

README.md:3README.md:13poc_cve_unifi.go:240-339

Requirements

  • Network access to the target UniFi Network ApplicationREADME.md:19
  • Explicit authorization to test the targetREADME.md:19

Observed behavior

  • Sends HTTP GET requests to predefined UniFi endpoints with path traversal payloads in the 'path' query parameterpoc_cve_unifi.go:252-255
  • Checks response body for strings like 'root:', 'daemon:', 'nobody:' or length > 500 to flag possible vulnerabilitypoc_cve_unifi.go:287-290
  • Reports suspicious responses without modifying the target systemREADME.md:13
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Behavior
HTTP GET requests to user-supplied target with path traversal payloadsThe scanner sends requests only to the target specified by the operator, consistent with a proof-of-concept vulnerability scanner.poc_cve_unifi.go:252-255poc_cve_unifi.go:341-363
Tls Configuration
InsecureSkipVerify: trueTLS certificate verification is disabled, which is a common practice in security testing tools but reduces transport security. This is disclosed in the README and does not constitute a backdoor.poc_cve_unifi.go:117README.md:101
Review boundaries

What the analysis did not establish

  • Evidence includes only two text files (README.md and poc_cve_unifi.go); three non-text media files (images) and one unclassified file are present but not analyzed.
  • The artifact's complete_artifact_coverage is false; the unclassified file and non-text media are not inspected, so the full repository content is not represented.
  • Three non-text media files (images) and one unclassified file are present in the repository but were not analyzed; their content could not be reviewed.
  • The review is limited to static analysis of the provided source text; runtime behavior was not observed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1