CVE-2026-3838: RCE in Unraid Update System

The vulnerability resides within the update.php file, specifically due to insufficient validation of user-supplied paths. An attacker who can authenticate to the Unraid system can craft a malicious request that leverages this path traversal flaw. This allows them to read or write files outside of the intended directory, ultimately enabling arbitrary code execution. Given that Unraid often runs with root privileges, successful exploitation grants the attacker full control over the system, including access to sensitive data stored on the NAS, the ability to install malware, and potential lateral movement to other devices on the network. This vulnerability shares similarities with other path traversal exploits where attackers manipulate file paths to bypass security controls.

1. Reserved2026-03-09
2. Published2026-03-13
3. Modified2026-03-16
4. EPSS updated2026-03-23

The primary mitigation is to immediately upgrade Unraid to a patched version. Until the upgrade is possible, consider implementing temporary workarounds. A Web Application Firewall (WAF) can be configured to block requests containing suspicious path traversal patterns, such as sequences of ../. Carefully review and restrict file access permissions within the Unraid environment to limit the potential impact of a successful exploit. Monitor Unraid logs for unusual activity, particularly requests to the update.php file. After upgrade, confirm by attempting a system update and verifying that the version number reflects the patched release.