---
id: "CVE-2026-119250"
kind: "vulnerability"
aliases: ["CVE-2026-119250"]
title: "WiFiman Desktop for macOS: file path flaw enables root command execution locally"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "WiFiman Desktop for macOS", "fixed": ["1.3.0"], "affected": "<= 1.2.8", "ecosystem": "vendor"}]
ecosystems: []
tags: ["local-privilege-escalation", "macos", "other", "ubiquiti", "wifiman-desktop"]
not_affected_if: ["no-wifiman-desktop-installed", "single-user-mac", "wifiman-desktop-1.3.0-or-later", "windows-or-linux-only"]
published_at: "2026-10-29T19:17:21+00:00"
first_seen_at: "2026-10-29T19:26:48+00:00"
updated_at: "2026-10-29T19:29:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119250", "first_seen_at": "2026-10-29T19:26:48+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-29T19:29:56+00:00"}]
---

# WiFiman Desktop for macOS: file path flaw enables root command execution locally

WiFiman Desktop for macOS has an external control of file name or path flaw that lets a local user with low privileges run arbitrary commands as root. The sources give no further technical detail on the exact code path.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:WiFiman Desktop for macOS affected <= 1.2.8 fixed 1.3.0

## How to check

Open WiFiman Desktop on the Mac and check the version in the app (About). Versions 1.2.8 and earlier are affected; 1.3.0 or later is fixed. If installed with Homebrew: brew list --cask --versions wifiman

## Fix

Update WiFiman Desktop for macOS to version 1.3.0 or later.

## Timeline

- 2026-10-29T19:26:48+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119250
- 2026-10-29T19:29:56+00:00 analyst — Read Ubiquiti Bulletin 072 (primary): affected WiFiman Desktop for macOS <= 1.2.8, fixed in 1.3.0. Credit @AndrewMohawk. No exploitation or PoC found; social posts not searched (fresh). Sibling CVEs 119249, 119251 are in the same bulletin.

## Documents

- [advisory] Ubiquiti Security Advisory Bulletin 072 https://community.ui.com/releases/Security-Advisory-Bulletin-072/351a6d54-3ef7-49b4-ac99-b3a5388a9808
- [fix] WiFiman Desktop 1.3.0 https://community.ui.com/releases/WiFiman-Desktop-1-3-0/1125a09a-f4ec-4a8a-9fc4-1562d7c7e151

## From the sources

A malicious actor with local access and low privileges could exploit an External Control of File Name or Path vulnerability found in WiFiman Desktop for macOS to execute arbitrary commands with root privileges on the host device.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_