Critical Path Traversal RCE (CVE‑2026‑3838) in Unraid Update Request Allows Remote Code Execution as Root
What It Is — A newly disclosed vulnerability (CVE‑2026‑3838) in Unraid’s update.php endpoint permits an authenticated remote attacker to traverse arbitrary file system paths and execute malicious code with root privileges. The flaw stems from insufficient validation of a user‑supplied path before file operations are performed.
Exploitability — Authentication is required, but once valid credentials are obtained the exploit is trivial; a public proof‑of‑concept has been released. CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) classifies it as a high‑severity remote code execution risk.
Affected Products — All Unraid installations prior to version 7.2.4 are vulnerable. The vendor has issued a fix in Unraid 7.2.4.
TPRM Impact — Unraid is widely used as a low‑cost NAS/storage platform for SaaS providers, media services, and internal backup solutions. A compromised Unraid node can expose third‑party data, serve as a foothold for lateral movement, and jeopardize the broader supply chain.
Recommended Actions —
- Upgrade every Unraid instance to version 7.2.4 or later immediately.
- Enforce strict network segmentation for storage nodes.
- Review authentication and update logs for suspicious activity.
- Deploy host‑based intrusion detection to monitor unexpected file changes.
- Validate that all third‑party vendors using Unraid have applied the patch.