What is the CVSS score of CVE-2026-9772?

CVE-2026-9772 has a CVSS 3.0 base score of 8.8 (High). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.1%.

Which versions of Unraid are affected by CVE-2026-9772?

A remote code execution vulnerability in Unraid's web-based file upload feature allows authenticated users to execute arbitrary system commands with web server privileges, creating an insider threat…

How to fix or mitigate CVE-2026-9772?

Within 24 hours: Inventory all Unraid deployments; restrict web UI access to trusted administrative networks only and disable remote access unless operationally critical; review and audit user accounts with upload privileges. Within 7 days: Implement network segmentation to isolate Unraid systems from general user networks; enable file upload logging and monitor for suspicious activity; revoke web UI access for non-essential user accounts. Within 30 days: Monitor Unraid vendor security advisories for patch release; if patch timeline extends beyond 60 days, evaluate air-gapped deployment or alternative storage solutions; develop incident response procedures for FileUpload.php exploitation attempts.

Unraid CVE-2026-9772

EUVD-2026-39108 HIGH

OS Command Injection (CWE-78)

2026-06-24 zdi

GHSA-mg2m-r63r-jgvm

Command Injection RCE PHP Unraid

8.8

CVSS 3.0 · Vendor: zdi

Severity by source

Vendor (zdi) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable web endpoint (AV:N) with simple injection (AC:L) but requires a valid login (PR:L); command execution as www-data yields full C/I/A compromise of the host.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (zdi).

CVSS VectorVendor: zdi

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 22:22 vuln.today

DescriptionCVE.org

Unraid Web Server FileUpload Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Unraid. Authentication is required to exploit this vulnerability.

The specific flaw exists within FileUpload.php. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the www-data user. Was ZDI-CAN-30116.

Articles & Coverage 1

News 8 New PHP Vulnerabilities - 1 Critical, 7 High, 2 With POC Jun 25, 2026

AnalysisAI

Authenticated remote code execution in Unraid stems from OS command injection in the web server's FileUpload.php, where a user-supplied string is passed to a system call without validation, letting any logged-in attacker run arbitrary commands as the www-data user. Tracked as ZDI-CAN-30116 and disclosed via the Zero Day Initiative, it carries a CVSS 8.8 rating; no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Unraid is a proprietary, Slackware-based NAS and virtualization operating system whose management plane is a PHP web application. The flaw is a classic CWE-78 OS command injection: FileUpload.php constructs a shell/system call incorporating attacker-controlled input without sanitizing or escaping shell metacharacters, so crafted input breaks out of the intended command and executes additional commands. The CPE cpe:2.3:a:unraid:unraid:*:*:*:*:*:*:*:* identifies the Unraid application itself as affected, with no upper version boundary specified in the available data, and execution occurs in the context of the web server account (www-data) rather than root.

RemediationAI

No vendor-released patch identified at time of analysis and no fix version is present in the provided data; consult the ZDI advisory at https://www.zerodayinitiative.com/advisories/ZDI-26-385/ and Unraid's official release notes for an updated build, then upgrade to the fixed version once published. As compensating controls until a patch is confirmed: ensure the Unraid web management interface is never exposed directly to the internet and is reachable only over a trusted LAN or VPN (trade-off: remote admins must connect through the VPN); restrict who holds web UI accounts and enforce strong, unique credentials since exploitation requires an authenticated session (trade-off: tighter account management overhead); and place the management port behind a firewall rule limiting source IPs to administrative hosts (trade-off: breaks access from unlisted networks). Avoid relying on the file upload feature from untrusted accounts where feasible.