Live › vulnerability › CVE-2020-5847
Go to dashboardUnraid, a NAS and server OS, has an insecure use of PHP's extract function that lets a remote attacker run code as root. It is chainable with CVE-2020-5849 for initial access and is listed as exploited in the wild.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 0h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Unraid Unraid | vendor | – | – |
Check the installed Unraid version in the web UI under Tools > Update OS and compare it to the fixed release in the vendor advisory. unknown for the exact affected version range in the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Unraid contains a vulnerability due to the insecure use of the extract PHP function that can be abused to execute remote code as root. This CVE is chainable with CVE-2020-5849 for initial access.
CISA required action: Apply updates per vendor instructions.
This page as .md · .json · in your agent: get_signal("CVE-2020-5847")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.