# CVE-2026-9772: Unraid OS command injection in FileUpload.php

Source: https://junglewise.ai/threats/cve-2026-9772-unraid-os-command-injection-in-fileupload-php  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-24. Updated: 2026-06-24  
License: CC BY 4.0 with a link back

CVE-2026-9772 · Severity: high · CVSS 8.8 · Published 2026-06-24

Unraid, a popular operating system for managing home servers and network-attached storage (NAS), contains a security flaw in its web-based management interface. An authorized user can exploit this weakness to run unauthorized commands on the server. This could lead to a total compromise of the system, allowing an attacker to access, modify, or delete stored data and disrupt server operations.

Vendors: [Unraid](https://junglewise.ai/threats/vendors/unraid).

## Quick answers

**Is CVE-2026-9772 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9772 being exploited in the wild.

**How severe is CVE-2026-9772?** High severity, with a CVSS score of 8.8, published 24 June 2026.

**Which products and versions are affected?** Unraid OS versions prior to 7.3.0 stable.

**Is there a fix for CVE-2026-9772?** A patch was published on 2026-06-24: Fixed in version 7.3.0 stable Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-9772 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-9772?** Check whether you run Unraid OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An OS command injection vulnerability exists in the FileUpload.php component of the Unraid web server. The flaw stems from insufficient validation of user-supplied strings before they are passed to a system call. A remote attacker with low-privileged authentication can exploit this by sending a specially crafted request to the web interface. Successful exploitation allows for arbitrary code execution in the context of the www-data user. The issue is resolved in Unraid OS version 7.3.0 stable.

## Affected products

- Unraid Unraid OS versions prior to 7.3.0 stable

## Timeline

- 2026-04-22: disclosed: Vulnerability reported to vendor
- 2026-06-24: advisory: Coordinated public release of advisory
- 2026-06-24: patched: Fixed in version 7.3.0 stable

## References

- [https://www.zerodayinitiative.com/advisories/ZDI-26-385/](https://www.zerodayinitiative.com/advisories/ZDI-26-385/)

## Related threats

- [Unraid Web Server command injection in ToggleState.php](https://junglewise.ai/threats/cve-2026-9773-unraid-web-server-command-injection-in-togglestate-php)