Sonarr (Path Traversal) Schwachstelle

The impact of this vulnerability is significant due to the potential for unauthorized access to sensitive information. An attacker could exploit this flaw to read application configuration files, which often contain API keys and database credentials. Compromise of these credentials could lead to complete control over the Sonarr instance and potentially access to the underlying database. Furthermore, the attacker could read Windows system files and any user-accessible files on the same drive as the Sonarr installation, expanding the potential scope of the breach. This vulnerability highlights the importance of proper input validation and access controls to prevent unauthorized file access.

Organizations running Sonarr on Windows systems, particularly those with exposed APIs or weak network security, are at significant risk. Shared hosting environments where multiple users share the same server instance are also vulnerable, as an attacker could potentially exploit this vulnerability to access data belonging to other users.

• windows / supply-chain:

Get-Process -Name Sonarr | Select-Object -ExpandProperty Path

• windows / supply-chain:

Get-ScheduledTask | Where-Object {$_.TaskName -like '*Sonarr*'}

• windows / supply-chain:

reg query "HKLM\Software\Sonarr" /v APIKey

• generic web:

curl -I http://sonarr.example.com/../../../../etc/passwd

1. 2026-03-25Disclosure

   disclosure

1. Reserviert2026-03-07
2. Veröffentlicht2026-03-25
3. Geändert2026-03-26
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2026-30976 is to upgrade Sonarr to version 4.0.17.2950 or later. This version includes a fix that restricts file access to the intended directory. If upgrading immediately is not possible, consider implementing temporary workarounds such as restricting file system permissions for the Sonarr user account to only the necessary directories. Additionally, review and rotate any API keys or database credentials that may have been exposed. Monitor Sonarr logs for any unusual file access attempts. After upgrading, confirm the fix by attempting to access files outside the intended directory via the Sonarr API; access should be denied.