A critical path traversal vulnerability in Sonarr on Windows systems allows unauthenticated remote attackers to read sensitive application and system files.

This vulnerability is a path traversal flaw (CWE-22) where the application fails to restrict file access to intended directories. An unauthenticated remote attacker can exploit this via the API to read arbitrary files on the host machine, including configuration files containing API keys and database credentials.

The ability for an unauthenticated attacker to read arbitrary files poses a high risk to organizational security. Successful exploitation could lead to the exposure of sensitive credentials, database contents, and system files, potentially facilitating further unauthorized access or total compromise of the host environment. The CVSS score of 8.6 reflects the high severity of this remote, unauthenticated access vector.

Immediate Action: Update Sonarr to version 4.0.17.2952 (stable branch) or 4.0.17.2950 (nightly/develop branch) immediately.

Proactive Monitoring: Monitor API access logs for anomalous requests containing directory traversal sequences, such as multiple dot-dot-slash patterns.

Compensating Controls: Restrict access to the Sonarr interface by hosting it exclusively on a secure internal network and requiring authentication via a VPN, Tailscale, or similar secure tunnel.

Public Exploit Available: No confirmed public exploit found.

Given the potential for complete exposure of sensitive application credentials, administrators must prioritize patching this vulnerability immediately. If an immediate update is not feasible, ensure the service is isolated from the public internet using network-level access controls to mitigate the risk of unauthorized remote exploitation.