AIKIDO-2026-11099
uiprotect is vulnerable to Path Traversal
30
Low Risk
This Affects:
uiprotectTL;DR
The uiprotect backup CLI builds local output file paths directly from camera display names without sanitizing them. A camera whose display name contains directory traversal sequences or absolute path components causes backup writes for thumbnails, gifs, and event clips to escape the configured output folder, allowing files to be written or overwritten in arbitrary locations. Exploitation requires an attacker-influenced camera name and a user running the backup command. The fix sanitizes camera names into safe slugs and validates that every joined path and glob match stays inside the output directory.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
uiprotect is vulnerable to Path Traversal in versions 0.1.0 - 10.18.0.
How to fix this
Upgrade the uiprotect library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant