CVE-2026-9772: Unraid Web Server FileUpload RCE Flaw

CVE-2026-9772 Overview

CVE-2026-9772 is a command injection vulnerability in the Unraid web server that allows authenticated remote attackers to execute arbitrary code on affected installations. The flaw resides in FileUpload.php, which fails to properly validate a user-supplied string before passing it to a system call. Successful exploitation grants code execution in the context of the www-data user. The Zero Day Initiative tracks the issue as ZDI-CAN-30116 and published advisory ZDI-26-385. The vulnerability is classified under CWE-78 (OS Command Injection) and carries a CVSS 3.0 score of 8.8.

Critical Impact
Authenticated attackers can achieve remote code execution as www-data on Unraid systems exposed over the network, leading to full compromise of stored data and downstream services.

Affected Products

Unraid (NAS operating system) — web management interface
FileUpload.php component of the Unraid web server
Specific fixed versions were not enumerated in the published advisory

Discovery Timeline

2026-06-24 - CVE-2026-9772 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-9772

Vulnerability Analysis

The vulnerability exists in the FileUpload.php handler of the Unraid web server. The script accepts user-controlled input and incorporates it into an operating system command without sanitization or safe argument handling. An authenticated attacker can craft an upload request that injects shell metacharacters into the parameter consumed by the system call. The injected command executes with the privileges of the www-data web server account.

Because the attack vector is the network and the only prerequisite is a valid low-privileged session, the issue is suitable for use after initial credential compromise, phishing, or weak default credential scenarios common on home and SMB NAS deployments. Following exploitation, attackers can stage payloads, persist on the device, pivot to internal networks, or destroy data stored on Unraid arrays.

Root Cause

The root cause is missing input validation and unsafe construction of a shell command string in FileUpload.php. The application passes attacker-influenced data to a system-level execution function instead of using parameterized APIs or strict allowlisting. This is a textbook CWE-78 OS Command Injection condition.

Attack Vector

Exploitation requires network reachability to the Unraid web interface and valid authentication. The attacker submits a crafted request to the file upload endpoint containing shell metacharacters such as ;, |, backticks, or $() within a parameter that is later interpolated into a system call. The server executes the injected command, returning code execution as www-data. No user interaction is required beyond the attacker's authenticated session.

No verified public proof-of-concept code is currently available. See the Zero Day Initiative Advisory ZDI-26-385 for additional technical context.

Detection Methods for CVE-2026-9772

Indicators of Compromise

Unexpected child processes spawned by the Unraid PHP-FPM or web server process tree under the www-data account
HTTP POST requests to FileUpload.php containing shell metacharacters such as ;, &&, ||, |, backticks, or $( in parameter values
New or modified files in web-writable directories with timestamps correlating to suspicious upload requests
Outbound network connections initiated by www-data to previously unseen hosts shortly after upload activity

Detection Strategies

Inspect web server access and error logs for requests to FileUpload.php that include encoded or raw shell metacharacters in query string or POST body fields
Apply process-lineage detections that flag shell interpreters (sh, bash, python, perl) spawned as children of the web server under www-data
Correlate authentication events on the Unraid management UI with subsequent process execution telemetry to identify post-login command execution

Monitoring Recommendations

Forward Unraid web server, authentication, and host process logs to a centralized analytics platform for correlation across login and process events
Baseline normal www-data process behavior and alert on deviations such as network tools, compilers, or download utilities
Monitor egress traffic from the NAS appliance for connections to non-corporate destinations, which Unraid hosts rarely initiate during normal operation

How to Mitigate CVE-2026-9772

Immediate Actions Required

Restrict access to the Unraid web management interface to trusted management VLANs or VPN clients only — do not expose it to the public internet
Rotate all Unraid user credentials and enforce strong, unique passwords to reduce the likelihood of an attacker meeting the authentication prerequisite
Review web server and authentication logs for prior exploitation attempts targeting FileUpload.php
Apply the vendor patch as soon as it is referenced in the ZDI-26-385 advisory update

Patch Information

At publication, the Zero Day Initiative Advisory ZDI-26-385 is the authoritative reference for CVE-2026-9772. Administrators should consult Unraid's official release notes for the security update addressing the FileUpload.php command injection and apply it on all affected appliances. Verify the fix is installed by confirming the updated package version after reboot.

Workarounds

Place the Unraid web interface behind a reverse proxy that enforces additional authentication and filters requests containing shell metacharacters
Limit which user accounts have access to the file upload functionality, granting upload rights only to administrators who require it
Disable remote access features such as My Servers or port forwards to the web UI until the patch is applied

bash

# Example: restrict Unraid web UI access to a management subnet using iptables
iptables -A INPUT -p tcp --dport 80 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP