CVE-2026-30976

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-30976", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-07T17:53:48.816Z", "datePublished": "2026-03-25T21:11:20.078Z", "dateUpdated": "2026-03-26T17:53:31.620Z"}, "containers": {"cna": {"title": "Sonarr Path Traversal vulnerability", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/Sonarr/Sonarr/security/advisories/GHSA-h393-v5hm-6h8f", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Sonarr/Sonarr/security/advisories/GHSA-h393-v5hm-6h8f"}, {"name": "https://github.com/Sonarr/Sonarr/releases/tag/v4.0.17.2950", "tags": ["x_refsource_MISC"], "url": "https://github.com/Sonarr/Sonarr/releases/tag/v4.0.17.2950"}, {"name": "https://github.com/Sonarr/Sonarr/releases/tag/v4.0.17.2952", "tags": ["x_refsource_MISC"], "url": "https://github.com/Sonarr/Sonarr/releases/tag/v4.0.17.2952"}], "affected": [{"vendor": "Sonarr", "product": "Sonarr", "versions": [{"version": ">= 4.0, < 4.0.17.2950", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-25T21:11:20.078Z"}, "descriptions": [{"lang": "en", "value": "Sonarr is a PVR for Usenet and BitTorrent users. In versions on the 4.x branch prior to 4.0.17.2950, an unauthenticated remote attacker can potentially read any file readable by the Sonarr process. These include application configuration files (containing API keys and database credentials), Windows system files, and any user-accessible files on the same drive This issue only impacts Windows systems; macOS and Linux are unaffected. Files returned from the API were not limited to the directory on disk they were intended to be served from. This problem has been patched in 4.0.17.2950 in the nightly/develop branch or 4.0.17.2952 for stable/main releases. It's possible to work around the issue by only hosting Sonarr on a secure internal network and accessing it via VPN, Tailscale or similar solution outside that network."}], "source": {"advisory": "GHSA-h393-v5hm-6h8f", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-26T17:53:23.067175Z", "id": "CVE-2026-30976", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-26T17:53:31.620Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-30976", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-26T17:53:23.067175Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-26T17:53:27.423Z"}}], "cna": {"title": "Sonarr Path Traversal vulnerability", "source": {"advisory": "GHSA-h393-v5hm-6h8f", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Sonarr", "product": "Sonarr", "versions": [{"status": "affected", "version": ">= 4.0, < 4.0.17.2950"}]}], "references": [{"url": "https://github.com/Sonarr/Sonarr/security/advisories/GHSA-h393-v5hm-6h8f", "name": "https://github.com/Sonarr/Sonarr/security/advisories/GHSA-h393-v5hm-6h8f", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/Sonarr/Sonarr/releases/tag/v4.0.17.2950", "name": "https://github.com/Sonarr/Sonarr/releases/tag/v4.0.17.2950", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/Sonarr/Sonarr/releases/tag/v4.0.17.2952", "name": "https://github.com/Sonarr/Sonarr/releases/tag/v4.0.17.2952", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Sonarr is a PVR for Usenet and BitTorrent users. In versions on the 4.x branch prior to 4.0.17.2950, an unauthenticated remote attacker can potentially read any file readable by the Sonarr process. These include application configuration files (containing API keys and database credentials), Windows system files, and any user-accessible files on the same drive This issue only impacts Windows systems; macOS and Linux are unaffected. Files returned from the API were not limited to the directory on disk they were intended to be served from. This problem has been patched in 4.0.17.2950 in the nightly/develop branch or 4.0.17.2952 for stable/main releases. It's possible to work around the issue by only hosting Sonarr on a secure internal network and accessing it via VPN, Tailscale or similar solution outside that network."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-25T21:11:20.078Z"}}}, "cveMetadata": {"cveId": "CVE-2026-30976", "state": "PUBLISHED", "dateUpdated": "2026-03-26T17:53:31.620Z", "dateReserved": "2026-03-07T17:53:48.816Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-25T21:11:20.078Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Sonarr", "vendor": "Sonarr", "versions": [{"status": "affected", "version": ">= 4.0, < 4.0.17.2950"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sonarr:sonarr:*:*:*:*:*:*:*:*", "matchCriteriaId": "15A94C78-5072-4BB2-9E51-622ECBB2650B", "versionEndExcluding": "4.0.17.2950", "versionStartIncluding": "4.0.0.741", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Sonarr is a PVR for Usenet and BitTorrent users. In versions on the 4.x branch prior to 4.0.17.2950, an unauthenticated remote attacker can potentially read any file readable by the Sonarr process. These include application configuration files (containing API keys and database credentials), Windows system files, and any user-accessible files on the same drive This issue only impacts Windows systems; macOS and Linux are unaffected. Files returned from the API were not limited to the directory on disk they were intended to be served from. This problem has been patched in 4.0.17.2950 in the nightly/develop branch or 4.0.17.2952 for stable/main releases. It's possible to work around the issue by only hosting Sonarr on a secure internal network and accessing it via VPN, Tailscale or similar solution outside that network."}, {"lang": "es", "value": "Sonarr es un PVR para usuarios de Usenet y BitTorrent. En versiones de la rama 4.x anteriores a la 4.0.17.2950, un atacante remoto no autenticado puede leer potencialmente cualquier archivo legible por el proceso de Sonarr. Estos incluyen archivos de configuraci\u00f3n de la aplicaci\u00f3n (que contienen claves de API y credenciales de base de datos), archivos del sistema de Windows y cualquier archivo accesible por el usuario en la misma unidad. Este problema solo afecta a los sistemas Windows; macOS y Linux no se ven afectados. Los archivos devueltos desde la API no estaban limitados al directorio en disco desde el que se supon\u00eda que deb\u00edan servirse. Este problema ha sido parcheado en la versi\u00f3n 4.0.17.2950 en la rama nightly/develop o en la 4.0.17.2952 para las versiones stable/main. Es posible solucionar el problema alojando Sonarr \u00fanicamente en una red interna segura y accedi\u00e9ndolo a trav\u00e9s de VPN, Tailscale o una soluci\u00f3n similar fuera de esa red."}], "id": "CVE-2026-30976", "lastModified": "2026-06-17T10:33:15.440", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-30976", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-26T17:53:23.067175Z", "version": "2.0.3"}}]}, "published": "2026-03-25T21:16:41.623", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/Sonarr/Sonarr/releases/tag/v4.0.17.2950"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/Sonarr/Sonarr/releases/tag/v4.0.17.2952"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/Sonarr/Sonarr/security/advisories/GHSA-h393-v5hm-6h8f"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.0,4.0.17.2950)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Sonarr", "source": "cna", "vendor": "Sonarr"}, "product": "sonarr", "vendor": "sonarr"}], "analysis": {"en": {"generated_at": "2026-03-30T19:28:43.010364+00:00", "value": {"mitigation_remediation": ["Upgrade Sonarr to version 4.0.17.2952 or later.", "Verify that the update has been applied and that the application reports the new version.", "If an upgrade is not possible immediately, limit access to Sonarr to an internal network and expose it externally only through a secure VPN, Tailscale, or similar.", "Monitor Sonarr logs for suspicious file read requests and isolate the application via network segmentation."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized Remote File Disclosure"}, "threat_synthesis": {"affected_systems": "The flaw affects the Sonarr application on Windows platforms, specifically versions on the 4.x branch earlier than 4.0.17.2950. macOS and Linux deployments are not affected. The issue was patched in the nightly build 4.0.17.2950 and in the stable release 4.0.17.2952, and any later update includes a fix.", "description_and_impact": "A path traversal defect in Sonarr 4.x releases before 4.0.17.2950 permits an unauthenticated remote attacker to read any file the Sonarr process can access, including configuration files that hold API keys, database credentials, and system files. The flaw is a classic CWE\u201122 vulnerability that results in unauthorized file disclosure, potentially exposing sensitive data and enabling further attacks against the host. The data loss spans confidentiality and may lead to credential compromise.", "risk_and_exploitability": "The severity is high, reflected by a CVSS score of 8.6, while the EPSS score indicates a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a remote unauthenticated request to Sonarr over a network that can reach the instance. An attacker crafts a request to the API that triggers a path traversal, allowing read access to any accessible file. The impact is a loss of confidentiality for configuration and system files."}}}}, "created": "2026-03-26T11:31:27.283916+00:00", "updated": "2026-03-30T20:57:52.113142+00:00", "vendors": ["sonarr", "sonarr$PRODUCT$sonarr"]}