A path traversal defect in Sonarr 4.x releases before 4.0.17.2950 permits an unauthenticated remote attacker to read any file the Sonarr process can access, including configuration files that hold API keys, database credentials, and system files. The flaw is a classic CWE‑22 vulnerability that results in unauthorized file disclosure, potentially exposing sensitive data and enabling further attacks against the host. The data loss spans confidentiality and may lead to credential compromise.

The flaw affects the Sonarr application on Windows platforms, specifically versions on the 4.x branch earlier than 4.0.17.2950. macOS and Linux deployments are not affected. The issue was patched in the nightly build 4.0.17.2950 and in the stable release 4.0.17.2952, and any later update includes a fix.

The severity is high, reflected by a CVSS score of 8.6, while the EPSS score indicates a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a remote unauthenticated request to Sonarr over a network that can reach the instance. An attacker crafts a request to the API that triggers a path traversal, allowing read access to any accessible file. The impact is a loss of confidentiality for configuration and system files.