Unraid Web Server FileUpload Command Injection Remote Code Execution Vulnerability allows authenticated remote attackers to execute arbitrary shell commands on affected installations. The flaw lies in FileUpload.php, where an unvalidated user‑supplied string is used in a system call, creating a classic command injection scenario (CWE‑78). By exploiting this, an attacker can run any code in the context of the www‑data user, potentially gaining full control over the host, including data theft, persistence, and propagation to other services.

Unraid's core package (Unraid:Unraid) is affected. No specific version information was disclosed in the advisory; therefore, all current installations should be considered at risk until an official patch is applied.

CVSS score of 8.8 indicates high severity. EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires authentication, meaning an attacker must first obtain valid credentials or otherwise access a legitimate user account. Once authenticated, the attacker can perform command injection via the file upload feature, raising the risk of complete system compromise. Given the high CVSS score and the need for authenticated access, the threat is significant but limited to environments where attackers can reach the upload endpoint and possess user credentials.