This vulnerability arises from insufficient validation of a user-supplied string in the ToggleState.php script, allowing attackers to inject arbitrary shell commands that are executed with the privileges of the www-data user. The consequence of a successful exploit is full remote code execution on the affected Unraid host. The weakness is a classic command-injection flaw (CWE‑78).

All Unraid installations that include the vulnerable ToggleState.php component are affected. Exact version numbers are not provided in the advisory, so any configuration exposing this endpoint should be considered vulnerable until a patch is applied.

The CVSS score of 8.8 denotes high severity, and the requirement for authentication limits exploitation to users with valid credentials to the Unraid web interface. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Attackers would need network access to the Unraid web interface and valid login credentials to supply malicious input to the toggle state API endpoint, after which arbitrary code is executed as www-data.