CVE-2026-9772: Unraid Web Server FileUpload Command Injection Remote Code Execution Vulnerability

High severity · published Jun 24, 2026

CVE-2026-9772

Unraid Web Server FileUpload Command Injection Remote Code Execution Vulnerability

8.8

CVSS

1.9%

EPSS

On KEV

Description

Unraid Web Server FileUpload Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Unraid. Authentication is required to exploit this vulnerability. The specific flaw exists within FileUpload.php. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the www-data user. Was ZDI-CAN-30116.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)1.9% · higher than 79% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Unraid · Unraid

1161ec120 · source: vendor, NVD

In the news

VulnerabilityHigh

ZDI-26-385: Unraid Web Server FileUpload Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Unraid. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-9772.

CVE-2026-9772

Jun 24, 2026·Zero Day Initiative

Affected product

Unraid

All Unraid CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-9772

CVE.org

https://www.cve.org/CVERecord?id=CVE-2026-9772

Third Party Advisory

https://www.zerodayinitiative.com/advisories/ZDI-26-385/