CVE-2026-30976 Details
Description
Sonarr is a PVR for Usenet and BitTorrent users. In versions on the 4.x branch prior to 4.0.17.2950, an unauthenticated remote attacker can potentially read any file readable by the Sonarr process. These include application configuration files (containing API keys and database credentials), Windows system files, and any user-accessible files on the same drive This issue only impacts Windows systems; macOS and Linux are unaffected. Files returned from the API were not limited to the directory on disk they were intended to be served from. This problem has been patched in 4.0.17.2950 in the nightly/develop branch or 4.0.17.2952 for stable/main releases. It's possible to work around the issue by only hosting Sonarr on a secure internal network and accessing it via VPN, Tailscale or similar solution outside that network.
A path traversal vulnerability has been identified in Sonarr, a PVR application for Usenet and BitTorrent users. This issue affects versions in the 4.x branch prior to 4.0.17.2950 and is exclusive to Windows systems. The vulnerability allows an unauthenticated remote attacker to read any file accessible by the Sonarr process. This includes application configuration files containing API keys and database credentials, Windows system files, and any user-accessible files on the same drive. The vulnerability arises because files returned from the web server were not restricted to the intended directory, potentially exposing sensitive information through the API.
Users can upgrade to Sonarr version 4.0.17.2950 in the nightly/develop branch or version 4.0.17.2952 for stable/main releases. For those unable to upgrade, the application can be hosted on a secure internal network and accessed via VPN, Tailscale, or a similar solution.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Sonarr/Sonarr/releases/tag/v4.0.17.2950 | [email protected] | Release Notes |
| https://github.com/Sonarr/Sonarr/releases/tag/v4.0.17.2952 | [email protected] | Release Notes |
| https://github.com/Sonarr/Sonarr/security/advisories/GHSA-h393-v5hm-6h8f | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| sonarr sonarr | >= 4.0.0.741, < 4.0.17.2950 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 9, 2026 | Reanalysis | [email protected] |
| Mar 30, 2026 | Initial Analysis | [email protected] |
| Mar 25, 2026 | New CVE Received | [email protected] |