CVE-2026-30976
Path Traversal in Sonarr 4.x on Windows Allows Remote File Disclosure
Publication date: 2026-03-25
Last updated on: 2026-04-09
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sonarr | sonarr | From 4.0.0.741 (inc) to 4.0.17.2950 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-30976 is a high-severity path traversal vulnerability in Sonarr versions 4.x prior to 4.0.17.2950. It allows an unauthenticated remote attacker to read any file that the Sonarr process can access on a Windows system. This includes sensitive files such as application configuration files containing API keys and database credentials, Windows system files, and any user-accessible files on the same drive. The root cause is that the Sonarr webserver did not properly restrict file access to intended directories, enabling directory traversal attacks.
This vulnerability only affects Sonarr running on Windows; macOS and Linux versions are not impacted. It has been patched in versions 4.0.17.2950 (nightly/develop) and 4.0.17.2952 (stable/main).
How can this vulnerability impact me? :
This vulnerability can have serious impacts because it allows an attacker to remotely and without authentication read any file accessible by the Sonarr process on a Windows system. This can lead to exposure of sensitive information such as API keys, database credentials, and system files.
Such unauthorized access can compromise the security of the affected system, potentially enabling further attacks or data breaches.
The CVSS v3.1 base score for this vulnerability is 8.6 (High), indicating a significant risk.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability affects Sonarr versions on the 4.x branch prior to 4.0.17.2950 running on Windows systems. Detection involves identifying if a vulnerable Sonarr version is running and if unauthorized file access attempts are occurring.
You can check the Sonarr version by querying the application or inspecting the installed version. For example, on Windows, you might check the version via the Sonarr UI or by examining the executable properties.
To detect exploitation attempts, monitor network traffic for unusual HTTP requests that attempt to access files outside the intended directories via path traversal patterns (e.g., requests containing '../' sequences).
Suggested commands include:
- Use PowerShell to check the installed Sonarr version: Get-Command Sonarr | Select-Object Version
- Monitor HTTP access logs for suspicious path traversal attempts, e.g., grep for '../' or encoded variants in logs.
- Use network monitoring tools (like Wireshark or tcpdump) to capture and analyze HTTP requests targeting the Sonarr service for suspicious file path patterns.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation is to upgrade Sonarr to a patched version: 4.0.17.2950 (nightly/develop branch) or 4.0.17.2952 (stable/main releases).
If immediate upgrade is not possible, restrict access to the Sonarr service by hosting it only on a secure internal network.
Access Sonarr remotely only through secure methods such as VPN, Tailscale, or similar secure tunneling solutions to prevent unauthenticated external access.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows an unauthenticated remote attacker to read any file accessible by the Sonarr process on Windows systems, including application configuration files containing sensitive data such as API keys and database credentials.
Exposure of sensitive information like API keys and credentials could lead to unauthorized access or data breaches, which may impact compliance with data protection regulations such as GDPR and HIPAA that require safeguarding sensitive data.
Organizations using affected Sonarr versions on Windows systems should consider this vulnerability a significant risk to confidentiality and take immediate remediation or mitigation steps to maintain compliance.