Unraid systems are vulnerable to a path traversal flaw in the update.php file that allows attackers to supply a crafted file path and execute arbitrary code as root. The vulnerability is a CWE-22 type (Path Traversal). Because the application does not validate the user‑supplied path before performing file operations, a remote authenticated attacker can run any code on the host, compromising confidentiality, integrity, and availability.

Affected installations belong to the Unraid operating system, specifically version 7.2.3 as identified by the CPE entry. The flaw originates from the update.php file in this release.

The CVSS score of 8.8 indicates high severity. EPSS of 2% suggests a relatively low probability of exploitation in the current environment, yet the vulnerability is not listed in CISA’s KEV catalog. The attack requires authentication, implying that an attacker must have valid credentials or an authenticated session on the Unraid web interface. Once authentication is achieved, the exploitation path is straightforward and yields root‑level code execution.