CVE-2026-30976

Sonarr is a PVR for Usenet and BitTorrent users. In versions on the 4.x branch prior to 4.0.17.2950, an unauthenticated remote attacker can potentially read any file readable by the Sonarr process. These include application configuration files (containing API keys and database credentials), Windows system files, and any user-accessible files on the same drive This issue only impacts Windows systems; macOS and Linux are unaffected. Files returned from the API were not limited to the directory on disk they were intended to be served from. This problem has been patched in 4.0.17.2950 in the nightly/develop branch or 4.0.17.2952 for stable/main releases. It's possible to work around the issue by only hosting Sonarr on a secure internal network and accessing it via VPN, Tailscale or similar solution outside that network.

• CWE-22

• https://github.com/Sonarr/Sonarr/releases/tag/v4.0.17.2950Release Notes
• https://github.com/Sonarr/Sonarr/releases/tag/v4.0.17.2952Release Notes
• https://github.com/Sonarr/Sonarr/security/advisories/GHSA-h393-v5hm-6h8fVendor Advisory

Published

Mar 25, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-30969Coral Server is open collaboration infrastructure that enabl…9.1
• CVE-2026-30970Coral Server is open collaboration infrastructure that enabl…9.1
• CVE-2026-30972Parse Server is an open source backend that can be deployed …7.5
• CVE-2026-30973Appium is an automation framework that provides WebDriver-ba…6.5
• CVE-2026-30974Copyparty is a portable file server. Prior to v1.20.11., the…5.4
• CVE-2026-30975Sonarr is a PVR for Usenet and BitTorrent users. Versions pr…9.8
• CVE-2026-30977RenderBlocking is a MediaWiki extension that allows interfac…2
• CVE-2026-30978iccDEV provides a set of libraries and tools for working wit…7.8
• CVE-2026-30979iccDEV provides a set of libraries and tools for working wit…7.8
• CVE-2026-3098The Smart Slider 3 plugin for WordPress is vulnerable to Arb…6.5
• CVE-2026-30980iccDEV provides a set of libraries and tools for working wit…5.5
• CVE-2026-30981iccDEV provides a set of libraries and tools for working wit…6.1