CVE-2025-50983 is a SQL Injection vulnerability identified in the Readarr application, specifically affecting version 0.4.15.2787. The vulnerability resides in the 'sortKey' parameter of the GET /api/v1/wanted/cutoff API endpoint. This parameter does not properly sanitize user input, allowing attackers to inject arbitrary SQL commands directly into the backend SQLite database. Exploitation has been confirmed using sqlmap, a popular automated SQL injection tool, which demonstrated the ability to execute stacked queries. This means an attacker can run multiple SQL statements in a single request, significantly increasing the potential impact. The use of SQLite functions such as RANDOMBLOB() and HEX() in a heavy query simulation indicates that attackers can perform complex database operations, potentially leading to data exfiltration, unauthorized data modification, or denial of service through resource exhaustion. The vulnerability does not currently have a CVSS score assigned, and there is no evidence of known exploits in the wild at this time. However, the technical details confirm deep control over the database through this injection point, highlighting a critical weakness in input validation and query construction within the Readarr API.

For European organizations using Readarr, particularly those managing large digital media libraries or metadata repositories, this vulnerability poses a significant risk. Successful exploitation could lead to unauthorized disclosure of sensitive data stored in the SQLite database, including user information or media metadata. Attackers could also manipulate or delete data, disrupting operations and potentially causing loss of data integrity. Given that Readarr is often deployed in home or small business environments, the impact might be more pronounced in organizations relying on it for cataloging or media management. Additionally, if Readarr instances are exposed to the internet or poorly segmented within internal networks, attackers could leverage this vulnerability as an entry point for lateral movement or further compromise. The absence of authentication requirements for the vulnerable endpoint (not explicitly stated but implied by the nature of the API) would exacerbate the risk, allowing unauthenticated attackers to exploit the flaw remotely. This could lead to reputational damage, compliance issues under GDPR if personal data is compromised, and operational disruptions.

Immediate mitigation should focus on input validation and sanitization of the 'sortKey' parameter to prevent injection of malicious SQL code. Developers should implement parameterized queries or prepared statements within the Readarr codebase to eliminate direct concatenation of user input into SQL commands. Until an official patch is released, organizations should restrict access to the vulnerable API endpoint by implementing network-level controls such as IP whitelisting, VPN-only access, or firewall rules to limit exposure. Monitoring and logging API requests for unusual patterns or excessive query complexity can help detect attempted exploitation. Additionally, organizations should conduct an inventory to identify all Readarr instances and ensure they are not publicly accessible. Regular backups of the SQLite database are recommended to enable recovery in case of data corruption or deletion. Finally, organizations should stay alert for official patches or updates from Readarr and apply them promptly once available.