PT-2026-28130

CVE-2026-30976

Published

2026-03-25

Updated

2026-03-26

Description by

CVSS 3.1

8.6

High

MetricsAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Sonarr versions prior to 4.0.17.2950

Description Sonarr is a PVR for Usenet and BitTorrent users. An unauthenticated remote attacker can potentially read any file readable by the Sonarr process. This includes application configuration files (containing API keys and database credentials) and Windows system files. This issue only impacts Windows systems. Files returned from the API were not limited to the directory on disk they were intended to be served from.

Recommendations Update to version 4.0.17.2950 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Kwstubbs

Vendors

Affected products

Weakness enumeration

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')

Related identifiers