Unraid Update Request Path Traversal (Pfadüberschreitung) Remote Code Execution (Fernausführung von Code) Vulnerability

The impact of CVE-2026-3838 is significant due to the potential for remote code execution. A successful exploit allows an attacker to gain complete control over the Unraid server, potentially leading to data breaches, system compromise, and denial of service. Given the server's role in managing storage and virtual machines, the blast radius extends to all data and services hosted on the affected system. This vulnerability shares characteristics with other path traversal exploits where attackers manipulate file paths to access unauthorized resources and execute malicious code.

Organizations and individuals running Unraid NAS devices, particularly those with publicly exposed management interfaces or weak authentication practices, are at risk. Shared hosting environments utilizing Unraid are also vulnerable, as a compromised account on one virtual machine could potentially be leveraged to exploit this vulnerability on the host system.

• linux / server:

journalctl -u unraid -g 'update.php'

• linux / server:

ps aux | grep -i update.php

• generic web:

curl -I http://<unraid_ip>/update.php?file=../../../../etc/passwd | head -n 1

1. 2026-03-13Disclosure

   disclosure

1. Reserviert2026-03-09
2. Veröffentlicht2026-03-13
3. Geändert2026-03-16
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-3838 is to upgrade Unraid to the patched version. If an immediate upgrade is not feasible, consider implementing temporary workarounds such as restricting access to the update.php file through a Web Application Firewall (WAF) or proxy server. Configure the WAF to block requests containing suspicious path traversal patterns (e.g., '../'). Monitor Unraid logs for unusual activity, particularly requests to the update.php file. After upgrading, verify the fix by attempting a manual update and confirming that the path traversal vulnerability is no longer exploitable.