CVE-2026-3839

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3839", "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "state": "PUBLISHED", "assignerShortName": "zdi", "dateReserved": "2026-03-09T16:03:01.958Z", "datePublished": "2026-03-13T20:38:05.449Z", "dateUpdated": "2026-03-16T20:22:41.363Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "shortName": "zdi", "dateUpdated": "2026-03-13T20:38:05.449Z"}, "title": "Unraid Authentication Request Path Traversal Authentication Bypass Vulnerability", "descriptions": [{"lang": "en", "value": "Unraid Authentication Request Path Traversal Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Unraid. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the auth-request.php file. The issue results from the lack of proper validation of a user-supplied path prior to using it in authentications. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-28912."}], "affected": [{"vendor": "Unraid", "product": "Unraid", "versions": [{"version": "7.2.3", "status": "affected"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-172/", "name": "ZDI-26-172", "tags": ["x_research-advisory"]}], "dateAssigned": "2026-03-09T16:03:02.014Z", "datePublic": "2026-03-09T23:14:45.611Z", "source": {"lang": "en", "value": "Nicolas Chatelain (Nicocha30)"}, "metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "baseScore": 7.3, "baseSeverity": "HIGH"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-16T20:22:32.300247Z", "id": "CVE-2026-3839", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T20:22:41.363Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3839", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-16T20:22:32.300247Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T20:22:37.444Z"}}], "cna": {"title": "Unraid Authentication Request Path Traversal Authentication Bypass Vulnerability", "source": {"lang": "en", "value": "Nicolas Chatelain (Nicocha30)"}, "metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"}}], "affected": [{"vendor": "Unraid", "product": "Unraid", "versions": [{"status": "affected", "version": "7.2.3"}], "defaultStatus": "unknown"}], "datePublic": "2026-03-09T23:14:45.611Z", "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-172/", "name": "ZDI-26-172", "tags": ["x_research-advisory"]}], "dateAssigned": "2026-03-09T16:03:02.014Z", "descriptions": [{"lang": "en", "value": "Unraid Authentication Request Path Traversal Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Unraid. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the auth-request.php file. The issue results from the lack of proper validation of a user-supplied path prior to using it in authentications. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-28912."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "shortName": "zdi", "dateUpdated": "2026-03-13T20:38:05.449Z"}}}, "cveMetadata": {"cveId": "CVE-2026-3839", "state": "PUBLISHED", "dateUpdated": "2026-03-16T20:22:41.363Z", "dateReserved": "2026-03-09T16:03:01.958Z", "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e", "datePublished": "2026-03-13T20:38:05.449Z", "assignerShortName": "zdi"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "Unraid", "vendor": "Unraid", "versions": [{"status": "affected", "version": "7.2.3"}]}], "source": "zdi-disclosures@trendmicro.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:unraid:unraid:7.2.3:*:*:*:*:*:*:*", "matchCriteriaId": "D95356E9-EA87-443B-938B-89188AAB478B", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Unraid Authentication Request Path Traversal Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Unraid. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the auth-request.php file. The issue results from the lack of proper validation of a user-supplied path prior to using it in authentications. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-28912."}, {"lang": "es", "value": "Vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n por salto de ruta en la solicitud de autenticaci\u00f3n de Unraid. Esta vulnerabilidad permite a atacantes remotos omitir la autenticaci\u00f3n en instalaciones afectadas de Unraid. La autenticaci\u00f3n no es necesaria para explotar esta vulnerabilidad.\n\nLa falla espec\u00edfica existe en el archivo auth-request.php. El problema se debe a la falta de validaci\u00f3n adecuada de una ruta proporcionada por el usuario antes de usarla en las autenticaciones. Un atacante puede aprovechar esta vulnerabilidad para omitir la autenticaci\u00f3n en el sistema. Fue ZDI-CAN-28912."}], "id": "CVE-2026-3839", "lastModified": "2026-06-17T10:44:19.507", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 3.4, "source": "zdi-disclosures@trendmicro.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3839", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-16T20:22:32.300247Z", "version": "2.0.3"}}]}, "published": "2026-03-16T14:19:53.033", "references": [{"source": "zdi-disclosures@trendmicro.com", "tags": ["Third Party Advisory"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-172/"}], "sourceIdentifier": "zdi-disclosures@trendmicro.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "zdi-disclosures@trendmicro.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.2.3"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Unraid", "source": "cna", "vendor": "Unraid"}, "product": "unraid", "vendor": "unraid"}], "analysis": {"en": {"generated_at": "2026-03-17T16:54:25.500879+00:00", "value": {"mitigation_remediation": ["Apply a vendor\u2011supplied patch or upgrade Unraid OS to a version that fixes the auth-request.php path validation issue. If a patch is not yet available, restrict external access to the Unraid web interface to trusted IP addresses only. Monitor logs for anomalous authentication requests and validate that path parameters are correctly sanitized. Re\u2011check Unraid\u2019s advisory page for updates after the initial release of the fix."], "summary": {"action": "Patch Immediately", "impact": "Authentication Bypass"}, "threat_synthesis": {"affected_systems": "Affected vendor: Unraid; impacted product: Unraid OS 7.2.3. The cpe entry cpe:2.3:o:unraid:unraid:7.2.3:*:*:*:*:*:*:* indicates that only this version is listed as vulnerable; no other versions are explicitly reported as affected in the supplied data.", "description_and_impact": "This vulnerability in Unraid allows remote attackers to bypass authentication without any prior credentials by exploiting improper path validation in the auth-request.php file. The flaw enables a crafted request to supply a user-controlled path that is used in authentication logic, resulting in unauthorized access to the system. The attack achieves high impact by granting an attacker full control over the Unraid installation, exposing all stored data and exposing the platform to further exploitation. The weakness corresponds to CWE-22: Path Traversal.", "risk_and_exploitability": "The CVSS v3 score of 7.3 indicates medium\u2011to\u2011high severity. EPSS shows a probability of exploitation of less than 1 %, suggesting that while the vulnerability is high impact, the likelihood of real\u2011world exploitation is currently low, and it has not yet entered CISA\u2019s KEV catalog. Attackers can exploit this by sending a crafted HTTP request to auth-request.php containing a malicious path; the vulnerability exists remotely and does not require authentication to be used."}}}}, "created": "2026-03-16T09:23:39.020387+00:00", "updated": "2026-03-23T13:39:46.383037+00:00", "vendors": ["unraid", "unraid$PRODUCT$unraid"]}