PT-2026-28130 · Sonarr · Sonarr

Kwstubbs · Published 2026-03-25 · Updated 2026-03-26 · CVE-2026-30976

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Sonarr versions prior to 4.0.17.2950

Description Sonarr is a PVR for Usenet and BitTorrent users. An unauthenticated remote attacker can potentially read any file readable by the Sonarr process. This includes application configuration files (containing API keys and database credentials) and Windows system files. This issue only impacts Windows systems. Files returned from the API were not limited to the directory on disk they were intended to be served from.

Recommendations Update to version 4.0.17.2950 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-30976

GHSA-H393-V5HM-6H8F

Affected Products

Sonarr

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30976.json · Exploit
• https://github.com/Sonarr/Sonarr/security/advisories/GHSA-h393-v5hm-6h8f · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30976 · Security Note
• https://osv.dev/vulnerability/CVE-2026-30976 · Vendor Advisory
• https://github.com/Sonarr/Sonarr/releases/tag/v4.0.17.2950 · Note
• https://github.com/Sonarr/Sonarr/releases/tag/v4.0.17.2952 · Note
• https://twitter.com/TheHackerWire/status/2036921085560840678 · Twitter Post
• https://twitter.com/CveFindCom/status/2036921847573258257 · Twitter Post
• https://twitter.com/infoflowcloud/status/2037139178819891373 · Twitter Post
• https://twitter.com/CVEnew/status/2037137800840065096 · Twitter Post