{"id":"CVE-2020-5847","kind":"vulnerability","aliases":["CVE-2020-5847"],"related":[],"title":"Unraid Unraid: Unraid Remote Code Execution Vulnerability","description":"Unraid contains a vulnerability due to the insecure use of the extract PHP function that can be abused to execute remote code as root. This CVE is chainable with CVE-2020-5849 for initial access.\n\nCISA required action: Apply updates per vendor instructions.","summary":"Unraid, a NAS and server OS, has an insecure use of PHP's extract function that lets a remote attacker run code as root. It is chainable with CVE-2020-5849 for initial access and is listed as exploited in the wild.","severity":"critical","cvss":10.0,"epss":0.95844,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"Unraid Unraid","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","nas","self-hosted","unraid"],"not_affected_if":["managed-hosting"],"how_to_check":"Check the installed Unraid version in the web UI under Tools > Update OS and compare it to the fixed release in the vendor advisory. unknown for the exact affected version range in the sources.","fix":"Update Unraid to the fixed release per vendor instructions (CISA required action). Restrict the web UI to the LAN and do not expose it to the internet.","status":"open","published_at":"2020-03-16T18:15:12+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T20:29:29+00:00","updated_at":"2026-10-23T20:29:29+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T20:29:29Z","model":"claude-haiku-5-5","output":{"fix":"Update Unraid to the fixed release per vendor instructions (CISA required action). Restrict the web UI to the LAN and do not expose it to the internet.","summary":"Unraid, a NAS and server OS, has an insecure use of PHP's extract function that lets a remote attacker run code as root. It is chainable with CVE-2020-5849 for initial access and is listed as exploited in the wild.","category":"infrastructure","who_cares":["unraid","self-hosted","nas"],"confidence":0.8,"analyst_note":"Sources do not give the fixed Unraid version or affected range; check the Unraid vendor advisory and the CVE-2020-5849 entry for the chained path.","how_to_check":"Check the installed Unraid version in the web UI under Tools > Update OS and compare it to the fixed release in the vendor advisory. unknown for the exact affected version range in the sources.","needs_analyst":true,"not_affected_if":["managed-hosting"],"severity_if_unknown":"critical"},"cost_usd":0.000383,"input_tokens":2107,"output_tokens":345,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2020':9A,12A,52B,95C '-5847':10A,13A '-5849':53B,96C 'abus':82C 'access':56B,99C 'action':102C 'appli':103C 'attack':42B 'chainabl':49B,92C 'cisa':100C 'code':5A,44B,86C 'contain':66C 'cve':8A,11A,51B,90C,94C 'due':69C 'execut':6A,84C 'exploit':16B,61B 'extract':36B,76C 'function':37B,78C 'host':21B 'infrastructur':17B 'initi':55B,98C 'insecur':31B,72C 'instruct':107C 'let':39B 'list':59B 'nas':18B,25B 'os':28B 'per':105C 'php':34B,77C 'remot':4A,41B,85C 'requir':101C 'root':46B,88C 'run':43B 'self':20B 'self-host':19B 'server':27B 'unraid':1A,2A,3A,14A,15A,22B,23B,65C 'updat':104C 'use':32B,73C 'vendor':106C 'vulner':7A,68C 'wild':64B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2020-03-16T18:15:12+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2020-5847","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-5847","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T11:39:18+00:00","note":null},{"source":"epss","external_id":"CVE-2020-5847","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-5847","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2020-5847","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-5847","severity":null,"published_at":"2020-03-16T18:15:12+00:00","modified_at":"2026-06-17T03:22:19+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}