UnPoller Path Traversal / Arbitrary File Read via file:// Password Prefix (CVE-2026-36851)

Metadata

Affected Target

Summary

UnPoller supports a file:// prefix convention for its UniFi controller password configuration value, intended to read the password from a file on disk. However, the path following the file:// prefix is not restricted, allowing path traversal to read arbitrary files from the host filesystem — the contents of which are then transmitted to the configured (attacker-controllable) UniFi controller URL during the authentication handshake.

Vulnerability Details

Root Cause

The file:// password-loading feature does not validate or restrict the supplied file path, permitting path traversal outside the intended credentials directory.

Attack Vector

1. Set UnPoller’s UniFi password configuration value to file://../../../../etc/passwd (or another sensitive path).
2. Point the configured UniFi controller URL at an attacker-controlled server.
3. UnPoller reads the arbitrary file’s contents and transmits them as the “password” during its authentication request to the attacker’s server, exfiltrating the file.

Impact

Arbitrary file read/exfiltration from the host running UnPoller, limited to whatever files the UnPoller process can read.

Environment / Lab Setup

Target:   UnPoller v2.33.0 configured with a `file://`-prefixed password value
Attacker: Any HTTP server to receive the exfiltrated file contents

Proof of Concept

PoC Script

See up.conf.example in this folder.

1

Use up.conf.example as a template, set the password to file://<traversal-path>, point the controller URL at an attacker-controlled listener, and run UnPoller

Demonstrates the path-traversal-driven file exfiltration by configuring UnPoller to read an arbitrary file as its “password” and observing it arrive at an attacker-controlled endpoint.

Detection & Indicators of Compromise

Signs of compromise:

• UnPoller configuration files containing file:// password values with traversal sequences (../)
• Unexpected UnPoller outbound connections to non-UniFi-controller hosts

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/SyntaxSaiyan/CVE-2026-36851 on 2026-07-05.