CVE-2025-13131 Overview
CVE-2025-13131 is an insecure default permissions vulnerability affecting Sonarr 4.0.15.2940. The flaw resides in the Sonarr.Console.exe binary located at C:\ProgramData\Sonarr\bin\Sonarr.Console.exe, which is executed as a Windows service. Improper default permissions on the service component allow a local, low-privileged user to manipulate the executable path. The weakness is categorized under CWE-266: Incorrect Privilege Assignment. The vendor confirmed the issue but classified it as low severity, arguing that exploitation requires either a highly privileged service account configuration or existing administrative access. A fix is planned for the next major release, Sonarr v5.
Critical Impact
A local attacker with low privileges can leverage insecure service permissions on Sonarr.Console.exe to compromise the confidentiality, integrity, and availability of the host.
Affected Products
- Sonarr 4.0.15.2940 (Windows service installation)
- File path: C:\ProgramData\Sonarr\bin\Sonarr.Console.exe
- Sonarr Service component on Windows hosts
Discovery Timeline
- 2025-11-13 - CVE-2025-13131 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-13131
Vulnerability Analysis
Sonarr installs a Windows service that launches Sonarr.Console.exe from C:\ProgramData\Sonarr\bin\. The ProgramData directory tree is often writable by standard users, and the Sonarr installation preserves permissive default access control lists on its subdirectories. A local attacker can replace or manipulate the executable, or files it depends on, before the service starts. When the service subsequently runs, it executes attacker-controlled code in the security context assigned to the service account.
The vendor notes that under the default configuration the service runs as an unprivileged user, which limits impact. However, deployments that reconfigure the service to run as LOCAL SYSTEM or another privileged account expose the host to privilege escalation. The CWE-266 classification reflects an authorization design error rather than a memory safety flaw.
Root Cause
The root cause is incorrect default permissions applied to the Sonarr installation directory and its service binary. Files created under C:\ProgramData\Sonarr\bin\ inherit access control entries that permit modification by non-administrative users. Windows services execute the on-disk binary at each start, so a writable service executable becomes a direct code execution primitive for whichever account runs the service.
Attack Vector
Exploitation requires local access and low privileges on the target host. An attacker overwrites Sonarr.Console.exe, replaces a DLL loaded by the process, or plants a malicious file that the service will execute on the next start or reboot. When the service restarts, the attacker payload runs under the configured service identity. Remote exploitation is not possible; the attack vector is strictly local per the CVSS v4.0 vector published for this CVE.
No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score reflects a low projected exploitation probability in the near term.
Detection Methods for CVE-2025-13131
Indicators of Compromise
- Unexpected modification timestamps on C:\ProgramData\Sonarr\bin\Sonarr.Console.exe or sibling DLLs.
- Non-administrative user or group entries in the ACL of the Sonarr installation directory.
- Sonarr service configured to run as LocalSystem or another privileged account instead of the default service user.
- Child processes spawned by Sonarr.Console.exe that are inconsistent with normal Sonarr operation, such as cmd.exe, powershell.exe, or LOLBins.
Detection Strategies
- Enumerate NTFS permissions on C:\ProgramData\Sonarr\ recursively and flag any entries that grant write or modify rights to Users, Authenticated Users, or Everyone.
- Query the Sonarr service configuration and alert when the ObjectName value is a privileged account.
- Monitor Windows Event ID 4663 for write access to the Sonarr binary directory by non-administrative security principals.
Monitoring Recommendations
- Enable file integrity monitoring on C:\ProgramData\Sonarr\bin\ to detect binary replacement.
- Alert on service configuration changes to the Sonarr service via Event ID 7040 and registry writes to HKLM\SYSTEM\CurrentControlSet\Services\Sonarr.
- Track process lineage from Sonarr.Console.exe to identify anomalous child process creation.
How to Mitigate CVE-2025-13131
Immediate Actions Required
- Restrict the ACL on C:\ProgramData\Sonarr\ and C:\ProgramData\Sonarr\bin\ so that only Administrators and SYSTEM have write permissions.
- Verify the Sonarr service is running under its default unprivileged service user and not LocalSystem or a domain administrator account.
- Audit local accounts on hosts running Sonarr and remove unnecessary interactive logon rights.
Patch Information
No patch is currently available for Sonarr 4.0.15.2940. The vendor has stated the issue will be resolved in the next major release, Sonarr v5. Track the Sonarr CVE discovery notes and the VulDB entry for updates.
Workarounds
- Manually harden directory permissions using icacls to remove non-administrative write access on the Sonarr installation directory.
- Do not reconfigure the Sonarr service to run under a privileged account; retain the default low-privilege service user.
- Isolate hosts running Sonarr from untrusted local users and disable unnecessary local logon rights.
# Configuration example: remove non-admin write access on the Sonarr binary directory
icacls "C:\ProgramData\Sonarr\bin" /inheritance:r
icacls "C:\ProgramData\Sonarr\bin" /grant:r "Administrators:(OI)(CI)F" "SYSTEM:(OI)(CI)F" "Users:(OI)(CI)RX"
# Verify the Sonarr service account is not privileged
sc.exe qc Sonarr
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
