CVE-2026-62965
HighCVSS 7.0Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
SABnzbd before version 5.1.0Beta3 allows an attacker with a valid API key to invoke orphan job deletion with a path parameter that is not confined to the download directory. An absolute path can cause recursive deletion of files or directories writable by the SABnzbd process. The API key is stored in plaintext in the configuration file.
Risk Assessment
An attacker can delete configuration, queue data, and downloaded files, causing data loss and service disruption. System files outside the user's ownership are not affected.
Recommendation
Update SABnzbd to version 5.1.0Beta3 or later. Protect the API key and configuration file from unauthorized access.
Other vulnerabilities in SABnzbd
Original NVD description (English source)
SABnzbd is an open source automated Usenet download tool. Prior to 5.1.0Beta3, orphan-job management in `sabnzbd/api.py` accepts the user-controlled `value` parameter without path confinement before `os.path.join()` with `download_dir`. An absolute path discards that base directory. An attacker with a valid API key can invoke `mode=status` with `name=delete_orphan` to reach `_api_delete_orphan` and `remove_all()` in `sabnzbd/filesystem.py`, which uses `shutil.rmtree()` for recursive deletion. The advisory also identifies `_api_add_orphan` and `_api_delete_all_orphan` as affected by the path-validation issue, while its concrete arbitrary-deletion trace is through `_api_delete_orphan`. The API key is stored in plaintext in `sabnzbd.ini`. The attacker can delete files or directories writable by the SABnzbd process, including configuration, queue data, and downloads, but system files outside the regular user's ownership are not affected. This issue is fixed in version 5.1.0Beta3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS