CVE-2024-40348 — AI Deep Analysis Summary

Q: What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Directory Traversal in Bazarr v1.4.3. 📉 **Consequences**: Unauthenticated attackers can read arbitrary files (e.g., /etc/passwd). Critical data leak risk! 💀

Q: Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: Lack of input validation on filename parameters. 🐛 **Flaw**: Allows path traversal sequences (`../`) to escape the intended directory. CWE-22 equivalent. 🔍

Q: Who is affected? (Versions/Components)

📦 **Affected**: Bazarr software. 📅 **Version**: v1.4.3 and prior. 🤝 **Context**: Companion app for Sonarr/Radarr. ⚠️ Check your subtitle manager version! 👀

Q: What can hackers do? (Privileges/Data)

🕵️ **Hackers Can**: Execute directory traversal. 📂 **Access**: Read sensitive system files (like `/etc/passwd`). 🔑 **Privileges**: Unauthenticated access required. No login needed! 🚪

Q: Is exploitation threshold high? (Auth/Config)

📉 **Threshold**: LOW. 🆔 **Auth**: None required. 🌐 **Config**: Exposed web interface is enough. Easy to exploit for anyone with network access. 🎯

Q: Is there a public Exp? (PoC/Wild Exploitation)

🔥 **Public Exp?**: YES. 📜 **PoCs**: Available on GitHub (bigb0x, NingXin2002) & Nuclei templates. 🚀 Automated scanning tools already exist. Wild exploitation likely! 🌍

Q: How to self-check? (Features/Scanning)

🔍 **Self-Check**: Use provided POC scripts. 🧪 **Test**: Send request to `/subtitles/../../../etc/passwd` (or similar traversal). 📄 **Look for**: File content in response. 🛠️

Q: Is it fixed officially? (Patch/Mitigation)

🛠️ **Fix**: Upgrade Bazarr to latest version. 📥 **Action**: Check official releases for patch > v1.4.3. 🔄 **Mitigation**: Update immediately if possible. ✅

Q: What if no patch? (Workaround)

🚧 **No Patch?**: Restrict network access to Bazarr port (7809). 🚫 **Block**: External access via firewall/WAF. 🛑 **Limit**: Only allow trusted internal IPs. 🔒

Q: Is it urgent? (Priority Suggestion)

🔴 **Urgency**: HIGH. 🚨 **Priority**: Critical. ⚡ **Reason**: Unauthenticated, public PoCs, sensitive data exposure. Patch NOW! ⏳

Updated May 06, 2026

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Directory Traversal in Bazarr v1.4.3. 📉 **Consequences**: Unauthenticated attackers can read arbitrary files (e.g., /etc/passwd). Critical data leak risk! 💀

Q2Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: Lack of input validation on filename parameters. 🐛 **Flaw**: Allows path traversal sequences (`../`) to escape the intended directory. CWE-22 equivalent. 🔍

Q3Who is affected? (Versions/Components)

📦 **Affected**: Bazarr software. 📅 **Version**: v1.4.3 and prior. 🤝 **Context**: Companion app for Sonarr/Radarr. ⚠️ Check your subtitle manager version! 👀

Q4What can hackers do? (Privileges/Data)

🕵️ **Hackers Can**: Execute directory traversal. 📂 **Access**: Read sensitive system files (like `/etc/passwd`). 🔑 **Privileges**: Unauthenticated access required. No login needed! 🚪

Q5Is exploitation threshold high? (Auth/Config)

📉 **Threshold**: LOW. 🆔 **Auth**: None required. 🌐 **Config**: Exposed web interface is enough. Easy to exploit for anyone with network access. 🎯

Q6Is there a public Exp? (PoC/Wild Exploitation)

🔥 **Public Exp?**: YES. 📜 **PoCs**: Available on GitHub (bigb0x, NingXin2002) & Nuclei templates. 🚀 Automated scanning tools already exist. Wild exploitation likely! 🌍

Q7How to self-check? (Features/Scanning)

🔍 **Self-Check**: Use provided POC scripts. 🧪 **Test**: Send request to `/subtitles/../../../etc/passwd` (or similar traversal). 📄 **Look for**: File content in response. 🛠️

Q8Is it fixed officially? (Patch/Mitigation)

🛠️ **Fix**: Upgrade Bazarr to latest version. 📥 **Action**: Check official releases for patch > v1.4.3. 🔄 **Mitigation**: Update immediately if possible. ✅

Q9What if no patch? (Workaround)

🚧 **No Patch?**: Restrict network access to Bazarr port (7809). 🚫 **Block**: External access via firewall/WAF. 🛑 **Limit**: Only allow trusted internal IPs. 🔒

Q10Is it urgent? (Priority Suggestion)

🔴 **Urgency**: HIGH. 🚨 **Priority**: Critical. ⚡ **Reason**: Unauthenticated, public PoCs, sensitive data exposure. Patch NOW! ⏳

Continue exploring

Vulnerability detail Full AI analysis (login) n/a