CVE-2026-9772 in Unraid
Summary
by MITRE • 06/25/2026
Unraid Web Server FileUpload Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Unraid. Authentication is required to exploit this vulnerability.
The specific flaw exists within FileUpload.php. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the www-data user. Was ZDI-CAN-30116.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 06/25/2026
This vulnerability represents a critical command injection flaw in Unraid's web server implementation that enables remote code execution through improper input validation in the FileUpload.php component. The vulnerability stems from insufficient sanitization of user-supplied data before being passed to system commands, creating an avenue for malicious actors to inject arbitrary commands into the underlying operating system. The issue specifically affects the FileUpload functionality where user-provided strings are directly incorporated into system calls without adequate validation or escaping mechanisms, making it susceptible to exploitation by attackers who can manipulate input fields during file upload operations.
The technical exploitation of this vulnerability requires an authenticated session, meaning that remote attackers must first establish valid credentials to access the web interface before attempting to leverage the command injection flaw. This authentication requirement does create a barrier to exploitation but does not eliminate the severity of the vulnerability since legitimate users with appropriate privileges could be compromised through credential theft or other attack vectors. When exploited successfully, the vulnerability allows execution of arbitrary commands with the privileges of the www-data user account, which typically runs the web server process and has access to web application resources and potentially system-level functionality depending on the server configuration.
The operational impact of this vulnerability extends beyond simple code execution as it provides attackers with persistent access to the affected Unraid system. Since the exploitation occurs within the web server context, attackers could potentially establish backdoors, exfiltrate sensitive data, or use the compromised system as a launch point for further attacks within the network infrastructure. The www-data user privileges may provide sufficient access to manipulate files, modify system configurations, or even escalate privileges depending on the specific system setup and permissions granted to the web server process. This vulnerability directly aligns with CWE-78 which describes improper neutralization of special elements used in OS commands, and maps to ATT&CK technique T1059.001 for command and script injection.
Mitigation strategies should focus on immediate patching of the FileUpload.php component to implement proper input validation and sanitization before any user-supplied data is processed in system calls. Organizations should also implement network segmentation to limit access to Unraid web interfaces, enforce strong authentication mechanisms including multi-factor authentication, and monitor for suspicious file upload activities. Additional protective measures include implementing web application firewalls to detect and block malicious payloads, restricting the privileges of the www-data user account to minimize potential damage from successful exploitation, and conducting regular security assessments of web applications to identify similar vulnerabilities in other components. The vulnerability demonstrates the critical importance of input validation and proper sanitization practices in preventing command injection attacks that can lead to complete system compromise.