Advisory Details

March 9th, 2026

Unraid Update Request Path Traversal Remote Code Execution Vulnerability

CVE ID	CVE-2026-3838
CVSS SCORE	8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AFFECTED VENDORS	Unraid
AFFECTED PRODUCTS	Unraid
VULNERABILITY DETAILS	This vulnerability allows remote attackers to execute arbitrary code on affected installations of Unraid. Authentication is required to exploit this vulnerability. The specific flaw exists within the update.php file. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of root.
ADDITIONAL DETAILS	Fixed in version 7.2.4.
DISCLOSURE TIMELINE	2026-02-19 - Vulnerability reported to vendor 2026-03-09 - Coordinated public release of advisory 2026-03-09 - Advisory Updated
CREDIT	Nicolas Chatelain (Nicocha30)

BACK TO ADVISORIES