CVE-2026-30976: 
NixOS vulnerability analysis and mitigation

CVE-2026-30976 is a path traversal vulnerability in Sonarr, a PVR application for Usenet and BitTorrent users, that allows unauthenticated remote attackers to read arbitrary files accessible to the Sonarr process on Windows systems. It affects all Sonarr 4.x versions from 4.0.0.741 up to (but not including) 4.0.17.2950; Sonarr v3 and installations on macOS and Linux are unaffected. The vulnerability was disclosed on March 25, 2026, and patched shortly after. It carries a CVSS v3.1 base score of 8.6 (High) per the GitHub Security Advisory, reflecting a scope-changed confidentiality impact (GitHub Advisory).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — Path Traversal): files returned by Sonarr's built-in web server were not restricted to the intended serving directory on disk, allowing path traversal sequences to escape the web root. An unauthenticated attacker can craft HTTP requests to the Sonarr API with traversal sequences (e.g., ../) to reference arbitrary file paths on the same Windows drive. No authentication, privileges, or user interaction are required, and the attack is conducted entirely over the network (GitHub Advisory). The vulnerability was reported to the Sonarr team by the GitHub Security Labs Team (credited as Kwstubbs) (GitHub Advisory).

A successful exploit allows an unauthenticated remote attacker to read any file on the Windows system that the Sonarr process has permission to access, including application configuration files containing API keys and database credentials, Windows system files, and any user-accessible files on the same drive. Exposure of API keys and credentials could enable further compromise of connected services or lateral movement within the environment. Confidentiality is fully impacted; integrity and availability are not directly affected by this vulnerability (GitHub Advisory, Feedly).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). No threat actor attribution has been reported. The EPSS score is approximately 0.062%, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the zero-authentication requirement and the sensitivity of potentially exposed data (API keys, credentials) make it an attractive target if Sonarr instances are exposed to the internet.

1. Reconnaissance: Identify internet-facing Sonarr instances running on Windows using tools like Shodan or Censys, searching for Sonarr's default port (typically 8989) and version banners indicating 4.x prior to 4.0.17.2950.
2. Craft traversal request: Send an unauthenticated HTTP GET request to the Sonarr web API, embedding path traversal sequences (e.g., ../../) in the file path parameter to escape the intended web root directory.
3. Target sensitive files: Attempt to read high-value files such as Sonarr's config.xml (containing API keys and database credentials), Windows system files (e.g., C:\Windows\System32\drivers\etc\hosts), or other user-accessible files on the same drive.
4. Exfiltrate credentials: Use recovered API keys or database credentials to authenticate to Sonarr's API or connected services, enabling further access or lateral movement within the environment (GitHub Advisory).

• Network: Unusual HTTP GET requests to the Sonarr web interface (default port 8989) containing path traversal sequences such as ../, ..%2F, or ..%5C in URL parameters; requests originating from unexpected external IP addresses.
• Logs: Sonarr access logs showing requests to file paths outside the application's web root directory; HTTP 200 responses to requests referencing system files (e.g., config.xml, hosts, SAM) or paths containing multiple .. segments.
• File System: No direct file system artifacts are expected from read-only exploitation, but review of recently accessed files (via Windows file auditing) may reveal unauthorized reads of sensitive configuration or system files.
• Process: No anomalous child processes are expected, as this is a read-only file disclosure vulnerability with no code execution component.

Sonarr has released patched versions: 4.0.17.2950 for the nightly/develop branch and 4.0.17.2952 for stable/main releases. All Windows users running Sonarr 4.x should upgrade immediately to one of these versions (GitHub Release 2950, GitHub Release 2952). As a temporary workaround for those unable to upgrade immediately, restrict Sonarr to a secure internal network and require external access only via VPN, Tailscale, or a similar secure tunnel solution to prevent unauthenticated internet-facing exposure (GitHub Advisory).

The Hacker Wire published a brief coverage piece on the vulnerability shortly after disclosure, highlighting the unauthenticated file read risk on Windows (The Hacker Wire). Yazoul.net published an advisory urging users to update immediately (Yazoul Advisory). Community reaction on Mastodon noted the severity of the unauthenticated access vector. The Sonarr team credited the GitHub Security Labs Team for responsible disclosure and released patches promptly (GitHub Advisory).