Critical Remote Code Execution in Unraid (CVE‑2020‑5847) Allows Root Access
What It Is — Unraid OS contains an insecure use of PHP’s extract function that can be leveraged to execute arbitrary code with root privileges. The flaw is publicly tracked as CVE‑2020‑5847.
Exploitability — The vulnerability is exploitable remotely; a proof‑of‑concept exists and it can be chained with CVE‑2020‑5849 to gain initial foothold. CVSS v3.1 scores it at 9.8 (Critical).
Affected Products — Unraid OS (all versions prior to the vendor‑released patch).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous vulnerability‑management controls that capture, prioritize, and remediate high‑severity flaws across the asset base.
- Provides audit‑ready evidence that an organization is actively monitoring third‑party software for known exploits, a key signal for buyers demanding defensible security postures.
- Highlights the importance of configuration‑management evidence (e.g., patch‑level inventories) to satisfy control objectives that map to multiple frameworks (NIST CSF, ISO 27001, etc.).
Recommended Actions
- Identify every Unraid instance in your environment via asset inventory.
- Apply the vendor‑issued patch immediately; verify the patch level with configuration‑management tooling.
- Enable logging of PHP execution errors and monitor for anomalous
extractusage. - Document the remediation steps in your control evidence repository to support audit readiness.
- Incorporate the vulnerability into your continuous risk‑assessment workflow.
Source: CISA KEV – CVE‑2020‑5847