A critical path traversal vulnerability in Unraid 7.2.3 allows unauthenticated remote attackers to bypass authentication controls and potentially gain unauthorized system access.

The vulnerability is a path traversal flaw located in the auth-request.php file, caused by insufficient validation of user-supplied paths. This allows an unauthenticated attacker to manipulate file paths to circumvent the authentication process entirely.

The ability for an unauthenticated remote attacker to bypass authentication poses a severe risk to data integrity and system confidentiality. Successful exploitation could lead to unauthorized administrative access, allowing attackers to modify system configurations, access sensitive data, or disrupt services. With a CVSS score of 7.3, this high-severity vulnerability represents a significant threat to infrastructure stability.

Immediate Action: Monitor official Unraid security advisories for the release of a patched version and apply the update immediately upon availability.

Proactive Monitoring: Review web server access logs for anomalous requests targeting the auth-request.php file or unusual directory traversal patterns.

Compensating Controls: Implement a Web Application Firewall (WAF) to block requests containing path traversal sequences, such as dot-dot-slash patterns, directed toward the affected endpoint.

Public Exploit Available: No

Given the ease of exploitation and the critical nature of an authentication bypass, administrators must prioritize this issue. Ensure that all external-facing Unraid instances are secured behind appropriate network controls and apply the vendor-supplied patch as soon as it is released to prevent unauthorized access.