PT-2026-24429 · Unraid · Unraid

Nicocha30 + 1 · Published 2026-03-09 · Updated 2026-03-16 · CVE-2026-3839

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Unraid (affected versions not specified)

Description A path traversal authentication bypass issue exists in Unraid’s authentication request process. This allows remote attackers to bypass authentication on affected systems without needing to authenticate. The flaw is located in the auth-request.php file and is due to insufficient validation of a user-supplied path before it is used during authentication. An attacker can exploit this to bypass authentication on the system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-3839

ZDI-26-172

Affected Products

Unraid

References · 3

• https://zerodayinitiative.com/advisories/ZDI-26-172 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-3839 · Security Note
• https://twitter.com/CVEnew/status/2032605855569359106 · Twitter Post