# CVE-2026-9773: Unraid Web Server command injection in ToggleState.php

Source: https://junglewise.ai/threats/cve-2026-9773-unraid-web-server-command-injection-in-togglestate-php  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-24. Updated: 2026-06-24  
License: CC BY 4.0 with a link back

CVE-2026-9773 · Severity: high · CVSS 8.8 · Published 2026-06-24

A security vulnerability exists in Unraid, a popular operating system for managing home servers and network-attached storage. An authorized user can exploit a flaw in the web management interface to run unauthorized commands on the server. This could allow an attacker to gain full control over the system, potentially leading to data theft, service disruption, or the installation of malicious software.

Vendors: [Unraid](https://junglewise.ai/threats/vendors/unraid).

## Quick answers

**Is CVE-2026-9773 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9773 being exploited in the wild.

**How severe is CVE-2026-9773?** High severity, with a CVSS score of 8.8, published 24 June 2026.

**Which products and versions are affected?** Unraid OS Versions prior to 7.3.0 stable.

**Is there a fix for CVE-2026-9773?** A patch was published on 2026-06-24: Fixed in version 7.3.0 stable Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-9773 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-9773?** Check whether you run Unraid OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A command injection vulnerability exists in the Unraid web server within the ToggleState.php component. The flaw is caused by insufficient validation of user-supplied input before it is passed to a system call. A remote, authenticated attacker can exploit this by sending a specially crafted request to execute arbitrary OS commands with the privileges of the 'www-data' user. The vulnerability is addressed in Unraid OS version 7.3.0 stable.

## Affected products

- Unraid Unraid OS Versions prior to 7.3.0 stable

## Timeline

- 2026-04-22: disclosed: Vulnerability reported to vendor
- 2026-06-24: advisory: Coordinated public release of advisory
- 2026-06-24: patched: Fixed in version 7.3.0 stable

## References

- [https://www.zerodayinitiative.com/advisories/ZDI-26-386/](https://www.zerodayinitiative.com/advisories/ZDI-26-386/)

## Related threats

- [Unraid OS command injection in FileUpload.php](https://junglewise.ai/threats/cve-2026-9772-unraid-os-command-injection-in-fileupload-php)