Unraid

Vulnerability activity for Unraid: what is being exploited, what was published lately, and when the next patch release is due.

All vendors Open in the dashboard

Last 30 days

CVEs: 0
Critical (CVSS 9+): 0
Exploited (CISA KEV): 0
With exploit code: 0

Last 90 days

CVEs: 0
Critical (CVSS 9+): 0
Exploited (CISA KEV): 0
With exploit code: 0

Last 365 days

CVEs: 4
Critical (CVSS 9+): 0
Exploited (CISA KEV): 0
With exploit code: 0

Exploited now

CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.

9.8CriticalMar 16, 2020Unraid Code / command injectionCVE-2020-5847Unraid contains a vulnerability due to the insecure use of the extract PHP function that can be abused to execute remote code as root. This CVE is chainable with CVE-2020-5849 for initial access.Added to KEV Nov 3, 2021 · 596 days after publicationExploited96% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
7.5HighMar 16, 2020Unraid Auth bypass / access controlCVE-2020-5849Unraid contains an authentication bypass vulnerability that allows attackers to gain access to the administrative interface. This CVE is chainable with CVE-2020-5847 for remote code execution.Added to KEV Nov 3, 2021 · 596 days after publicationExploited93% likelyExploit codeExploit-DB · Metasploit

Recent

8.8HighJun 24, 2026unraid Code / command injectionCVE-2026-9773Unraid Web Server ToggleState Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Unraid. Authentication is required to exploit this vulnerability. The specific flaw exists within ToggleState.php. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of th
8.8HighJun 24, 2026unraid Code / command injectionCVE-2026-9772Unraid Web Server FileUpload Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Unraid. Authentication is required to exploit this vulnerability. The specific flaw exists within FileUpload.php. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the
7.3HighMar 16, 2026unraid Path traversal / file handlingCVE-2026-3839Unraid Authentication Request Path Traversal Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Unraid. Authentication is not required to exploit this vulnerability. The specific flaw exists within the auth-request.php file. The issue results from the lack of proper validation of a user-supplied path prior to using it in authentications. An attacker can leverage this vulnerability to bypass authentication on the
8.8HighMar 16, 2026unraid Path traversal / file handlingCVE-2026-3838Unraid Update Request Path Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Unraid. Authentication is required to exploit this vulnerability. The specific flaw exists within the update.php file. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-C
7.5HighMar 16, 2020Unraid Auth bypass / access controlCVE-2020-5849Unraid contains an authentication bypass vulnerability that allows attackers to gain access to the administrative interface. This CVE is chainable with CVE-2020-5847 for remote code execution.Exploited93% likelyExploit codeExploit-DB · Metasploit
9.8CriticalMar 16, 2020Unraid Code / command injectionCVE-2020-5847Unraid contains a vulnerability due to the insecure use of the extract PHP function that can be abused to execute remote code as root. This CVE is chainable with CVE-2020-5849 for initial access.Exploited96% likelyExploit codeExploit-DB · Metasploit · NucleiDetection

See every Unraid entry on the dashboard.