Loading story…
Sonarr disclosed two high-severity vulnerabilities affecting 4.x releases: CVE-2026-30975, an authentication bypass in versions before 4.0.16.2942/4.0.16.2944, and CVE-2026-30976, a path traversal issue in versions before 4.0.17.2950/4.0.17.2952. The authentication bypass can be triggered when Sonarr is configured as "Disabled for Local Addresses" and is exposed without a reverse proxy that blocks or strips the invalid header used in the attack, potentially allowing unauthorized access. The path traversal flaw affects Windows deployments and could let an unauthenticated remote attacker read arbitrary files accessible to the Sonarr process.
The file-read exposure could include Sonarr configuration files containing API keys and database credentials, as well as Windows system files and other user-accessible files on the same drive. Sonarr has released fixes for both issues and advised administrators to upgrade promptly, enable authentication, avoid direct internet exposure, and place the service behind a properly configured reverse proxy or restrict access to an internal network using VPN or Tailscale-style remote access.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-30976 was publicly disclosed as a path traversal vulnerability affecting Sonarr 4.x versions prior to 4.0.17.2950 on Windows. The disclosure noted that exposed instances could allow unauthenticated reading of sensitive files, including configuration data and system files.
GitHub security advisories recorded CVE-2026-30975 on March 25, 2026, classifying it as an authentication bypass issue in Sonarr and assigning CWE-290 and a high-severity CVSS v3.1 score. The advisory documented affected versions prior to 4.0.16.2942 and listed mitigations such as enabling authentication and avoiding direct internet exposure.
Sonarr patched a Windows-only path traversal vulnerability later assigned CVE-2026-30976 in version 4.0.17.2950 for nightly/develop and 4.0.17.2952 for stable/main. The flaw could let an unauthenticated remote attacker read arbitrary files accessible to the Sonarr process.
Sonarr released fixes for an authentication bypass vulnerability later assigned CVE-2026-30975, with patched versions 4.0.16.2942 for the nightly/develop branch and 4.0.16.2944 for stable/main. The issue affected deployments using "Disabled for Local Addresses" authentication and exposed without a protective reverse proxy.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple vulnerabilities in **TrueConf Server** were disclosed as affecting Windows deployments, including a **high-severity authentication bypass** tracked as `BDU:2025-10114`. The flaw stems from an alternative path or channel weakness (`CWE-228`) that allows remote attackers to send certain API requests without proper authentication, including access to some `/admin/*` endpoints where authorization checks are not correctly enforced. Russian vulnerability records state the issue affects multiple versions before vendor-fixed releases, that **exploit code exists**, and that the vulnerability has been **observed in attacks**. A related TrueConf Server issue, `BDU:2025-10115`, allows attackers to **read arbitrary files** on affected systems, expanding the risk from unauthorized administrative access to potential exposure of sensitive local data. Positive Technologies flagged both `BDU:2025-10114` and `BDU:2025-10115` as **trending vulnerabilities**, while a third identifier, `BDU:2025-10116`, was also listed without public technical details. The vendor has confirmed the disclosed issues and recommends applying the latest software updates and following official remediation guidance.
Jun 29, 2026
Public proof-of-concept code has been released for three high-severity vulnerabilities in the open-source **File Browser** self-hosted file management application, including **`CVE-2026-73611`**, **`CVE-2026-73612`**, and **`CVE-2026-73613`**. The issues affect File Browser/File Server releases up to **2.63.21** in the broader advisory, while individual fixes were introduced in later versions, including **2.63.22** for the recursive-operations access-control flaw and **2.63.19** as unaffected for the symlink-based deletion issue. `CVE-2026-73612` allows authenticated users to bypass path-based access controls during recursive copy, rename, and delete operations, letting them manipulate restricted descendant files and directories. `CVE-2026-73613` enables arbitrary out-of-scope file deletion through symlink manipulation in the TUS upload cache eviction process, potentially deleting files outside an attacker’s authorized scope with only create permissions. Separately, `CVE-2026-73611` affects JWT-based proxy authentication and can allow expired tokens to be accepted and renewed under certain non-default logout configurations, creating an authentication and security-restrictions bypass risk. Organizations using File Browser have been urged to apply the latest vendor patches immediately.
Aug 14, 2026
Two high-severity vulnerabilities were disclosed affecting exposed application and device management surfaces, including a flaw that can give attackers **root access** and another that enables **arbitrary file write** through path traversal. **CVE-2026-3587** describes an unauthenticated remote attack path in a hidden CLI function that lets an attacker escape a restricted prompt and gain root access to the underlying Linux operating system, potentially leading to full device compromise. The issue was mapped to `CWE-912` and assigned a `CVSS v3.1` score vector of `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`, with CERT VDE publishing advisory `VDE-2026-020`. A separate vulnerability, **CVE-2026-5027**, affects Langflow's `POST /api/v2/files` endpoint, where improper sanitization of the multipart `filename` parameter allows path traversal using `../` sequences. An authenticated attacker can exploit the bug to write files to arbitrary filesystem locations, creating a route to compromise confidentiality, integrity, and availability. The flaw was classified as `CWE-22`, carries the `CVSS v3.1` vector `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`, and is referenced in Tenable advisory `TRA-2026-26`.
Jun 29, 2026