ZDI 2026-06-24

ZDI-26-385: Unraid Web Server FileUpload Command Injection Remote Code Execution Vulnerability

CVE-2026-9772

Machine-generated analysis · WAYSCloud LLM

The vulnerability requires authentication but allows remote code execution via a file upload command injection in the Unraid Web Server.

Context

The affected product is Unraid, specifically its Web Server component. The vulnerability is a command injection occurring during file upload, requiring an authenticated session. The advisory notes that arbitrary code execution is possible. Worth noting is that the CVSS score is high, reflecting substantial impact potential under the stated conditions.

Operator considerations

Check: Verify if Unraid systems are running the vulnerable Web Server component.

From Zero Day Initiative ↗

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Unraid. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-9772.

Read the full advisory on ZDI →