SABnzbd CVE-2026-62965

Requires possession of a valid SABnzbd API key (CVSS PR:H confirms authenticated access); the key is stored in plaintext in sabnzbd.ini. With the key, the attacker calls the orphan-job management API (mode=status with name=delete_orphan, reaching _api_delete_orphan; _api_add_orphan and _api_delete_all_orphan share the same unvalidated os.path.join flaw) and supplies an absolute path in the value parameter so the download_dir base is discarded. No non-default configuration is needed - orphan-job management is standard functionality, and no user interaction is required. Limiting factors: exploitation is capped to files and directories writable by the SABnzbd process user (config, queue DB, downloads), and cannot touch system files owned by other users; the practical barrier is obtaining the API key, which an unauthenticated network attacker does not have by default.

This is a genuine but privilege-gated integrity/availability issue, not a drive-by remote code execution. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H) scoring 7.0 is internally consistent with the description: exploitation is network-reachable and low-complexity, but PR:H reflects that a valid SABnzbd API key is required, so this is an authenticated attack rather than fully anonymous. No EPSS score was provided and the vulnerability is not in CISA KEV, so there is no signal of widespread or active exploitation; the vuln.today decision label is 'this_week' (not act_now/emergency), aligning with a prompt-but-not-crisis remediation posture. The GHSA advisory includes a working-looking PoC curl command, so exploit knowledge is public, though the input does not confirm it as packaged/weaponized exploit code. The real-world risk is bounded by two factors the raw 7.0 does not fully convey: the attacker must first obtain the API key (stored plaintext in sabnzbd.ini, so trivially recoverable only if the host or that file is already accessible), and the impact is confined to files writable by the SABnzbd process user - configuration, queue data, and downloads can be destroyed, but system files outside that user's ownership cannot. Net: a real priority for exposed/multi-user SABnzbd instances where the API key may leak, but materially lower urgency than the network vector alone suggests.

An attacker who has obtained a valid SABnzbd API key (for example from an exposed sabnzbd.ini, a shared or leaked configuration, or an over-permissioned local account) sends a single authenticated API request with an absolute path as the orphan-job value. A public PoC reference exists in the GHSA advisory (a curl invocation of mode=status&name=delete_orphan), and because os.path.join discards the download_dir base for absolute paths, the request triggers recursive deletion of the targeted directory via shutil.rmtree. The low attack complexity means no timing, grooming, or special sequencing is needed once the key is held.