CVE-2026-3838: Unraid Update Request Path Traversal Remote Code Execution Vulnerability

High severity · published Mar 13, 2026

CVE-2026-3838

Unraid Update Request Path Traversal Remote Code Execution Vulnerability

8.8

CVSS

0.9%

EPSS

On KEV

Description

Unraid Update Request Path Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Unraid. Authentication is required to exploit this vulnerability. The specific flaw exists within the update.php file. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-28951.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.9% · higher than 59% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Unraid · Unraid

7.2.3 · source: vendor, NVD

In the news

VulnerabilityHigh

ZDI-26-171: Unraid Update Request Path Traversal Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Unraid. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-3838.

CVE-2026-3838

Mar 9, 2026·Zero Day Initiative

Affected product

Unraid

All Unraid CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-3838

CVE.org

https://www.cve.org/CVERecord?id=CVE-2026-3838

Third Party Advisory

https://www.zerodayinitiative.com/advisories/ZDI-26-171/