PT-2026-52119 · Unraid · Unraid Web Server

CVE-2026-9772

·

Published

2026-06-24

·

Updated

2026-06-26

CVSS v3.1

8.8

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Unraid Web Server (affected versions not specified)
Description An authenticated remote attacker can execute arbitrary code on affected installations. The issue stems from improper validation of a user-supplied string within the FileUpload.php file before it is used to execute a system call. Successful exploitation allows the attacker to run code in the context of the www-data user.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

OS Command Injection

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-9772
ZDI-26-385

Affected Products

Unraid Web Server