CVE-2026-62965 Details
Description
SABnzbd is an open source automated Usenet download tool. Prior to 5.1.0Beta3, orphan-job management in `sabnzbd/api.py` accepts the user-controlled `value` parameter without path confinement before `os.path.join()` with `download_dir`. An absolute path discards that base directory. An attacker with a valid API key can invoke `mode=status` with `name=delete_orphan` to reach `_api_delete_orphan` and `remove_all()` in `sabnzbd/filesystem.py`, which uses `shutil.rmtree()` for recursive deletion. The advisory also identifies `_api_add_orphan` and `_api_delete_all_orphan` as affected by the path-validation issue, while its concrete arbitrary-deletion trace is through `_api_delete_orphan`. The API key is stored in plaintext in `sabnzbd.ini`. The attacker can delete files or directories writable by the SABnzbd process, including configuration, queue data, and downloads, but system files outside the regular user's ownership are not affected. This issue is fixed in version 5.1.0Beta3.
A path traversal vulnerability has been identified in SABnzbd versions prior to 5.1.0Beta3. The issue arises in the orphan-job management API, specifically within the '_api_delete_orphan' and '_api_add_orphan' handlers in 'sabnzbd/api.py'. These handlers accept a user-controlled 'value' parameter and pass it to 'os.path.join()' without proper path validation. This oversight allows an attacker with a valid API key to delete arbitrary files or directories that are writable by the SABnzbd process. The vulnerability is exploited by sending a request that includes an absolute path or a path traversal sequence, which the application fails to sanitize before performing a recursive deletion using 'shutil.rmtree()'. As a result, sensitive data such as configuration files, queue data, and downloaded content can be removed. The vulnerability does not impact system files outside the user's ownership.
Users can upgrade to SABnzbd version 5.1.0Beta3 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Nov 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/sabnzbd/sabnzbd/security/advisories/GHSA-hxwh-mmrg-p8f5 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/sabnzbd/sabnzbd/commit/e3e7fcf361eaebec2d76397b3d27f854f8266410 | [email protected] | Source CodeVendor |
| https://github.com/sabnzbd/sabnzbd/releases/tag/5.1.0Beta3 | [email protected] | Release NotesVendor |
| https://github.com/sabnzbd/sabnzbd/security/advisories/GHSA-hxwh-mmrg-p8f5 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| SABnzbd | < 5.1.0Beta3 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | [email protected] |