Sabnzbd
Monthly
Authenticated path traversal in SABnzbd before 5.1.0Beta3 lets a holder of a valid API key delete files and directories writable by the SABnzbd process, including its configuration, queue database, and downloads. The orphan-job status handlers pass the user-controlled value parameter into os.path.join() with download_dir, so an absolute path overrides the base and reaches recursive deletion through shutil.rmtree(); the advisory also flags _api_add_orphan and _api_delete_all_orphan for the same validation gap. No CISA KEV entry confirms active exploitation, and the vendor advisory includes a public curl-based PoC reference that was not independently verified as working exploit code; the issue is fixed in 5.1.0Beta3.
SABnzbd is an open source automated Usenet download tool. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
SABnzbd is an open source binary newsreader. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
SABnzbd 2.3.9 and 3.0.0Alpha2 has a command injection vulnerability in the web configuration interface that permits an authenticated user to execute arbitrary Python commands on the underlying. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This OS Command Injection vulnerability could allow attackers to execute arbitrary operating system commands on the host.
Authenticated path traversal in SABnzbd before 5.1.0Beta3 lets a holder of a valid API key delete files and directories writable by the SABnzbd process, including its configuration, queue database, and downloads. The orphan-job status handlers pass the user-controlled value parameter into os.path.join() with download_dir, so an absolute path overrides the base and reaches recursive deletion through shutil.rmtree(); the advisory also flags _api_add_orphan and _api_delete_all_orphan for the same validation gap. No CISA KEV entry confirms active exploitation, and the vendor advisory includes a public curl-based PoC reference that was not independently verified as working exploit code; the issue is fixed in 5.1.0Beta3.
SABnzbd is an open source automated Usenet download tool. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
SABnzbd is an open source binary newsreader. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
SABnzbd 2.3.9 and 3.0.0Alpha2 has a command injection vulnerability in the web configuration interface that permits an authenticated user to execute arbitrary Python commands on the underlying. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This OS Command Injection vulnerability could allow attackers to execute arbitrary operating system commands on the host.