CVE-2026-30976 - Vulnerability Analysis

Overview

Sonarr 4.x < 4.0.17.2950 on Windows contains a path traversal caused by unrestricted file access in the API, letting unauthenticated remote attackers read any file accessible by the Sonarr process, exploit requires network access to Sonarr API.

Severity & Score

Impact

Unauthenticated attackers can read sensitive files including configuration and system files, leading to information disclosure and potential further compromise.

Mitigation

Update to version 4.0.17.2950 or later.

References

• https://github.com/Sonarr/Sonarr/releases/tag/v4.0.17.2950
• https://github.com/Sonarr/Sonarr/releases/tag/v4.0.17.2952
• https://github.com/Sonarr/Sonarr/security/advisories/GHSA-h393-v5hm-6h8f

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 25, 2026

🟠 CVE-2026-30976 - High (8.6) Sonarr is a PVR for Usenet and BitTorrent users. In versions on the 4.x branch prior to 4.0.17.2950, an unauthenticated remote attacker can potentially read any file readable by the Sonarr process. These include application configuration files (co... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30976/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner