CVE-2026-3839

Unraid Authentication Request Path Traversal Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Unraid. Authentication is not required to exploit this vulnerability. The specific flaw exists within the auth-request.php file. The issue results from the lack of proper validation of a user-supplied path prior to using it in authentications. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-28912.

CVSS v3 7.3 HIGH

7.3^/10

CVSS v3 : HIGH

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Exploitability : 3.9 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://www.zerodayinitiative.com/advisories/ZDI-26-172/	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:o:unraid:unraid:7.2.3:*:*:*:*:*:*:*

History

17 Jun 2026, 10:44

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad de omisión de autenticación por salto de ruta en la solicitud de autenticación de Unraid. Esta vulnerabilidad permite a atacantes remotos omitir la autenticación en instalaciones afectadas de Unraid. La autenticación no es necesaria para explotar esta vulnerabilidad. La falla específica existe en el archivo auth-request.php. El problema se debe a la falta de validación adecuada de una ruta proporcionada por el usuario antes de usarla en las autenticaciones. Un atacante puede aprovechar esta vulnerabilidad para omitir la autenticación en el sistema. Fue ZDI-CAN-28912.

17 Mar 2026, 14:19

Type	Values Removed	Values Added
References	~~() https://www.zerodayinitiative.com/advisories/ZDI-26-172/ -~~	() https://www.zerodayinitiative.com/advisories/ZDI-26-172/ - Third Party Advisory
First Time		Unraid Unraid unraid
CPE		cpe:2.3:o:unraid:unraid:7.2.3:::::::*

16 Mar 2026, 14:19

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-03-16 14:19

Updated : 2026-06-17 10:44

NVD link : CVE-2026-3839

Mitre link : CVE-2026-3839

CVE.ORG link : CVE-2026-3839

JSON object : View

Products Affected

unraid

unraid

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-3839", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3839", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-16T20:22:32.300247Z"}}], "cvssMetricV30": [{"type": "Secondary", "source": "zdi-disclosures@trendmicro.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "zdi-disclosures@trendmicro.com", "affectedData": [{"vendor": "Unraid", "product": "Unraid", "versions": [{"status": "affected", "version": "7.2.3"}], "defaultStatus": "unknown"}]}], "published": "2026-03-16T14:19:53.033", "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-172/", "tags": ["Third Party Advisory"], "source": "zdi-disclosures@trendmicro.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "zdi-disclosures@trendmicro.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Unraid Authentication Request Path Traversal Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Unraid. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the auth-request.php file. The issue results from the lack of proper validation of a user-supplied path prior to using it in authentications. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-28912."}, {"lang": "es", "value": "Vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n por salto de ruta en la solicitud de autenticaci\u00f3n de Unraid. Esta vulnerabilidad permite a atacantes remotos omitir la autenticaci\u00f3n en instalaciones afectadas de Unraid. La autenticaci\u00f3n no es necesaria para explotar esta vulnerabilidad.\n\nLa falla espec\u00edfica existe en el archivo auth-request.php. El problema se debe a la falta de validaci\u00f3n adecuada de una ruta proporcionada por el usuario antes de usarla en las autenticaciones. Un atacante puede aprovechar esta vulnerabilidad para omitir la autenticaci\u00f3n en el sistema. Fue ZDI-CAN-28912."}], "lastModified": "2026-06-17T10:44:19.507", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:unraid:unraid:7.2.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D95356E9-EA87-443B-938B-89188AAB478B"}], "operator": "OR"}]}], "sourceIdentifier": "zdi-disclosures@trendmicro.com"}