PT-2026-28130 · Sonarr · Sonarr

Kwstubbs · Publicado 2026-03-25 · Atualizado 2026-03-26 · CVE-2026-30976

Positive Technologies (AI Summary)

CVSS v3.1

8.6

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Sonarr versions prior to 4.0.17.2950

Description Sonarr is a PVR for Usenet and BitTorrent users. An unauthenticated remote attacker can potentially read any file readable by the Sonarr process. This includes application configuration files (containing API keys and database credentials) and Windows system files. This issue only impacts Windows systems. Files returned from the API were not limited to the directory on disk they were intended to be served from.

Recommendations Update to version 4.0.17.2950 or later.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-30976

GHSA-H393-V5HM-6H8F

Produtos afetados

Sonarr

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30976.json · Exploit
• https://github.com/Sonarr/Sonarr/security/advisories/GHSA-h393-v5hm-6h8f · Aviso do Fabricante
• https://github.com/Sonarr/Sonarr/releases/tag/v4.0.17.2950 · Nota
• https://github.com/Sonarr/Sonarr/releases/tag/v4.0.17.2952 · Nota
• https://twitter.com/TheHackerWire/status/2036921085560840678 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-30976 · Nota de Segurança
• https://twitter.com/CveFindCom/status/2036921847573258257 · Publicação no Twitter
• https://twitter.com/infoflowcloud/status/2037139178819891373 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-30976 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2037137800840065096 · Publicação no Twitter