CVE-2026-3838
NONE EPSS 50.5%
Published Mar 16, 20263mo ago · Modified Mar 17, 20263mo ago
Published Mar 16, 2026 3mo ago
Last Modified Mar 17, 2026 3mo ago
Description
Unraid Update Request Path Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Unraid. Authentication is required to exploit this vulnerability. The specific flaw exists within the update.php file. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-28951.
Threat Intelligence
EPSS Exploit Probability
50.5% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-22 Path Traversal Resource Mgmt
Affected Products 1
| Vendor | Product | Version | Range |
|---|---|---|---|
| unraid | unraid | 7.2.3 | any |
References 1
- zerodayinitiative.com https://www.zerodayinitiative.com/advisories/ZDI-26-171/
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.