{"id":"CVE-2026-119250","kind":"vulnerability","aliases":["CVE-2026-119250"],"related":[],"title":"WiFiman Desktop for macOS: file path flaw enables root command execution locally","description":"A malicious actor with local access and low privileges could exploit an External Control of File Name or Path vulnerability found in WiFiman Desktop for macOS to execute arbitrary commands with root privileges on the host device.","summary":"WiFiman Desktop for macOS has an external control of file name or path flaw that lets a local user with low privileges run arbitrary commands as root. The sources give no further technical detail on the exact code path.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"WiFiman Desktop for macOS","fixed":["1.3.0"],"affected":"<= 1.2.8","ecosystem":"vendor"}],"ecosystems":[],"tags":["local-privilege-escalation","macos","other","ubiquiti","wifiman-desktop"],"not_affected_if":["no-wifiman-desktop-installed","single-user-mac","wifiman-desktop-1.3.0-or-later","windows-or-linux-only"],"how_to_check":"Open WiFiman Desktop on the Mac and check the version in the app (About). Versions 1.2.8 and earlier are affected; 1.3.0 or later is fixed. If installed with Homebrew: brew list --cask --versions wifiman","fix":"Update WiFiman Desktop for macOS to version 1.3.0 or later.","status":"open","published_at":"2026-10-29T19:17:21+00:00","first_seen_at":"2026-10-29T19:26:48+00:00","triaged_at":"2026-10-29T19:27:15+00:00","updated_at":"2026-10-29T19:29:56+00:00","category":"other","confidence":0.9,"triage":{"at":"2026-10-29T19:27:15Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"WiFiman Desktop for macOS: file path flaw enables root command execution locally","impact":"high","summary":"WiFiman Desktop for macOS has an external control of file name or path flaw that lets a local user with low privileges run arbitrary commands as root. The sources give no further technical detail on the exact code path.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wifiman-desktop","macos"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local low-privilege user runs commands as root on the Mac","analyst_note":"Find the vendor advisory or the NVD entry detail for affected WiFiman Desktop versions and the fixed version.","how_to_check":"- Check the installed WiFiman Desktop version on macOS in the app's About screen or under /Applications\n- unknown for any other check, as the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["no-wifiman-desktop-installed","windows-or-linux-only"],"who_is_affected":"Machines running WiFiman Desktop for macOS are affected. The attacker needs a local account on the machine, so exposure is mainly on shared or multi-user Macs. unknown whether other platforms or configurations are affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000655,"input_tokens":4086,"output_tokens":493,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor advisory or the NVD entry detail for affected WiFiman Desktop versions and the fixed version.","search":"'-119250':15A,18A '-2026':14A,17A 'access':77C 'actor':74C 'arbitrari':56B,100C 'code':70B 'command':10A,57B,101C 'control':40B,85C 'could':81C 'cve':13A,16A 'desktop':2A,20A,32B,34B,95C 'detail':66B 'devic':108C 'enabl':8A 'escal':26B 'exact':69B 'execut':11A,99C 'exploit':82C 'extern':39B,84C 'file':5A,42B,87C 'flaw':7A,46B 'for':21A 'found':92C 'give':62B 'host':107C 'let':48B 'local':12A,24B,50B,76C 'local-privilege-escal':23B 'low':53B,79C 'maco':4A,27B,36B,97C 'macos':22A 'malici':73C 'name':43B,88C 'path':6A,45B,71B,90C 'privileg':25B,54B,80C,104C 'root':9A,59B,103C 'run':55B 'sourc':61B 'technic':65B 'ubiqu':29B 'user':51B 'vulner':91C 'wifiman':1A,19A,31B,33B,94C 'wifiman-desktop':30B","nicknames":[],"mitigations":[],"who_affected":"Macs with WiFiman Desktop 1.2.8 or earlier installed. An attacker needs a local low-privilege account and can then run commands as root, so shared or multi-user Macs matter most. Windows and Linux builds are not named in the bulletin, and Macs without the app can skip it.","tier":"B","verified":{"fix":{"at":"2026-10-29T19:29:56Z","by":"analyst","doc":"https://community.ui.com/releases/WiFiman-Desktop-1-3-0/1125a09a-f4ec-4a8a-9fc4-1562d7c7e151","run_id":1103},"products":{"at":"2026-10-29T19:29:56Z","by":"analyst","doc":"https://community.ui.com/releases/WiFiman-Desktop-1-3-0/1125a09a-f4ec-4a8a-9fc4-1562d7c7e151","run_id":1103},"how_to_check":{"at":"2026-10-29T19:29:56Z","by":"analyst","doc":"https://community.ui.com/releases/WiFiman-Desktop-1-3-0/1125a09a-f4ec-4a8a-9fc4-1562d7c7e151","run_id":1103},"who_affected":{"at":"2026-10-29T19:29:56Z","by":"analyst","doc":"https://community.ui.com/releases/WiFiman-Desktop-1-3-0/1125a09a-f4ec-4a8a-9fc4-1562d7c7e151","run_id":1103}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T19:17:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"fe490ce8-0395-4072-90d8-2707e1bdf984","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119250","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119250","severity":null,"published_at":"2026-10-29T19:17:21+00:00","modified_at":"2026-10-29T19:17:21+00:00","first_seen_at":"2026-10-29T19:26:48+00:00","fetched_at":"2026-10-29T19:26:48+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119250:1103","url":null,"severity":null,"published_at":"2026-10-29T19:29:56+00:00","modified_at":"2026-10-29T19:29:56+00:00","first_seen_at":"2026-10-29T19:29:56+00:00","fetched_at":"2026-10-29T19:29:56+00:00","note":"Read Ubiquiti Bulletin 072 (primary): affected WiFiman Desktop for macOS <= 1.2.8, fixed in 1.3.0. Credit @AndrewMohawk. No exploitation or PoC found; social posts not searched (fresh). Sibling CVEs 119249, 119251 are in the same bulletin."}],"documents":[{"id":18906,"url":"https://community.ui.com/releases/Security-Advisory-Bulletin-072/351a6d54-3ef7-49b4-ac99-b3a5388a9808","title":"Ubiquiti Security Advisory Bulletin 072","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":18907,"url":"https://community.ui.com/releases/WiFiman-Desktop-1-3-0/1125a09a-f4ec-4a8a-9fc4-1562d7c7e151","title":"WiFiman Desktop 1.3.0","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}