Vulnerabilities

TI-2026-85376 CVE-2026-123033 · GHSA-m6c5-5946-f5rx

Authentication bypass in TrueNAS SCALE HA heartbeat origin check

LOW 36

Authentication bypass in the HA heartbeat origin check in middlewared in TrueNAS SCALE before 25.10.8 (and in release trains before their respective fixes) allows an attacker on the same network segment to achieve unauth…

CVSS 3.1HIGH 8.3 Adjacent network No auth No interaction EPSS 0.00442 Published 2026-11-05 Fixed in 25.10.8 CWE-290

TI-2010-05060 CVE-2010-20059 · GHSA-ffxm-wjwm-w3jp

FreeNAS < 0.7.2 rev 5543 exec_raw.php Arbitrary Command Execution

HIGH 81

FreeNAS 0.7.2 prior to revision 5543 includes an unauthenticated command‐execution backdoor in its web interface.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.01524 Published 2025-08-20 Fixed in 0.7.2 rev 5543 CWE-78

TI-2024-11083 CVE-2024-11946 · GHSA-2r3p-qwrg-gqxg

Cleartext transmission of sensitive information in iXsystems TrueNAS CORE

LOW 29

iXsystems TrueNAS CORE fetch_plugin_packagesites tar Cleartext Transmission of Sensitive Information Vulnerability.

CVSS 3.1MEDIUM 6.5 Adjacent network No auth No interaction EPSS 0.003 Published 2024-12-30 No fix listed CWE-319

TI-2024-11081 CVE-2024-11944 · GHSA-xpwc-vww2-w3pr

Path traversal in iXsystems TrueNAS CORE

MEDIUM 43

iXsystems TrueNAS CORE tarfile.extractall Directory Traversal Remote Code Execution Vulnerability.

CVSS 3.1HIGH 8.8 Adjacent network No auth No interaction EPSS 0.01588 Published 2024-12-30 No fix listed CWE-22

TI-2020-09348 CVE-2020-11650 · GHSA-jr46-4q88-9hjx

An issue was discovered in iXsystems FreeNAS (and TrueNAS) 11.2 before 11.2-u8 and 11.3…

LOW 38

An issue was discovered in iXsystems FreeNAS (and TrueNAS) 11.2 before 11.2-u8 and 11.3 before 11.3-U1.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02952 Published 2020-04-08 No fix listed CWE-307