CVE-2026-3838: Unraid Update Request Path Traversal Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Unraid. Authentication is required to exploit this vulnerability. The specific flaw exists within the update.php file. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of root.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3838?
CVE-2026-3838 is considered a high severity vulnerability due to its potential for remote code execution on affected Unraid installations.
How do I fix CVE-2026-3838?
To fix CVE-2026-3838, it is recommended to update Unraid to the latest version that addresses this vulnerability.
What is the impact of CVE-2026-3838 on Unraid systems?
CVE-2026-3838 allows authenticated remote attackers to execute arbitrary code, potentially compromising the system.
Who is affected by CVE-2026-3838?
CVE-2026-3838 affects installations of Unraid that have not been updated to include the security fixes.
Is authentication required to exploit CVE-2026-3838?
Yes, authentication is required to exploit CVE-2026-3838 on vulnerable Unraid installations.