CVE-2026-3838

High

Published: 16 March 2026

Published

16 March 2026

Modified

17 March 2026

KEV Added

—

Patch

—

CVSS Score v3 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0076 50.4th percentile

Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-3838 is a high-severity Path Traversal (CWE-22) vulnerability in Unraid Unraid. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 49.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

CVE-2026-3838 is a path traversal vulnerability in Unraid that permits remote code execution. The flaw resides in the update.php component, where insufficient validation of a user-supplied path allows the value to be used directly in file operations, enabling an attacker to execute arbitrary code. The issue carries a CVSS score of 8.8 and is tracked under CWE-22; it was originally reported as ZDI-CAN-28951.

Authenticated remote attackers can leverage the vulnerability to run code in the context of the root user on affected Unraid installations. No material change in EPSS is observed, with the score remaining flat at 0.0497. The Zero Day Initiative advisory ZDI-26-171 addresses the issue.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-12166

Vulnerability details

Unraid Update Request Path Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Unraid. Authentication is required to exploit this vulnerability. The specific flaw exists within the update.php file. The issue…

results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-28951.