{"id":"CVE-2026-62965","kind":"vulnerability","aliases":["CVE-2026-62965"],"related":[],"title":"SABnzbd: API orphan-job path check lets a key holder delete arbitrary directories","description":"SABnzbd is an open source automated Usenet download tool. Prior to 5.1.0Beta3, orphan-job management in `sabnzbd/api.py` accepts the user-controlled `value` parameter without path confinement before `os.path.join()` with `download_dir`. An absolute path discards that base directory. An attacker with a valid API key can invoke `mode=status` with `name=delete_orphan` to reach `_api_delete_orphan` and `remove_all()` in `sabnzbd/filesystem.py`, which uses `shutil.rmtree()` for recursive deletion. The advisory also identifies `_api_add_orphan` and `_api_delete_all_orphan` as affected by the path-validation issue, while its concrete arbitrary-deletion trace is through `_api_delete_orphan`. The API key is stored in plaintext in `sabnzbd.ini`. The attacker can delete files or directories writable by the SABnzbd process, including configuration, queue data, and downloads, but system files outside the regular user's ownership are not affected. This issue is fixed in version 5.1.0Beta3.","summary":"SABnzbd, a Usenet download tool, passes a user-supplied path to recursive deletion without confining it to the download directory, so an absolute path escapes the intended folder. An attacker holding a valid API key can delete files and directories the SABnzbd process can write to, including its config, queue and downloads.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","sabnzbd","self-hosted","usenet"],"not_affected_if":["api-not-exposed","version-5.1.0beta3-or-later"],"how_to_check":"- Check the installed SABnzbd version with `sabnzbd --version` or the version shown in the web interface; versions before `5.1.0Beta3` are affected.\n- Confirm whether the API is reachable from untrusted networks and whether the API key is shared widely.","fix":"- SABnzbd: move to `5.1.0Beta3` or later.","status":"open","published_at":"2026-10-30T21:17:14+00:00","first_seen_at":"2026-10-30T21:25:53+00:00","triaged_at":"2026-10-30T21:26:47+00:00","updated_at":"2026-10-30T21:26:47+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-30T21:26:47Z","model":"claude-haiku-5-5","output":{"fix":"- SABnzbd: move to `5.1.0Beta3` or later.","reach":"network","title":"SABnzbd: API orphan-job path check lets a key holder delete arbitrary directories","impact":"medium","summary":"SABnzbd, a Usenet download tool, passes a user-supplied path to recursive deletion without confining it to the download directory, so an absolute path escapes the intended folder. An attacker holding a valid API key can delete files and directories the SABnzbd process can write to, including its config, queue and downloads.","audience":"businesses","category":"package","nicknames":[],"who_cares":["sabnzbd","self-hosted","usenet"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker deletes files and directories writable by the SABnzbd process.","analyst_note":"","how_to_check":"- Check the installed SABnzbd version with `sabnzbd --version` or the version shown in the web interface; versions before `5.1.0Beta3` are affected.\n- Confirm whether the API is reachable from untrusted networks and whether the API key is shared widely.","plain_action":"","needs_analyst":false,"not_affected_if":["version-5.1.0Beta3-or-later","api-not-exposed"],"who_is_affected":"Any SABnzbd instance before 5.1.0Beta3 whose API can be reached by someone holding a valid API key. Exposure depends on whether the web API is exposed beyond trusted users; instances not reachable by untrusted parties carry less risk.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00072,"input_tokens":4374,"output_tokens":566,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-62965':17A,20A '5.1.0':91C,229C 'absolut':50B,115C 'accept':99C 'add':157C 'advisori':153C 'affect':165C,222C 'also':154C 'api':2A,61B,126C,138C,156C,160C,181C,185C 'arbitrari':13A,176C 'arbitrary-delet':175C 'attack':57B,122C,194C 'autom':85C 'base':119C 'beta3':92C,230C 'check':7A 'concret':174C 'config':76B 'configur':206C 'confin':42B,108C 'control':103C 'cve':15A,18A 'data':208C 'delet':12A,40B,64B,134C,139C,151C,161C,177C,182C,196C 'dir':113C 'directori':14A,47B,67B,120C,199C 'discard':117C 'download':30B,46B,79B,87C,112C,210C 'escap':52B 'file':65B,197C,213C 'fix':226C 'folder':55B 'hold':58B 'holder':11A 'host':25B 'identifi':155C 'includ':74B,205C 'intend':54B 'invok':129C 'issu':171C,224C 'job':5A,95C 'key':10A,62B,127C,186C 'let':8A 'manag':96C 'mode':130C 'name':133C 'open':83C 'orphan':4A,94C,135C,140C,158C,163C,183C 'orphan-job':3A,93C 'os.path.join':110C 'outsid':214C 'ownership':219C 'packag':21B 'paramet':105C 'pass':32B 'path':6A,37B,51B,107C,116C,169C 'path-valid':168C 'plaintext':190C 'prior':89C 'process':70B,204C 'queue':77B,207C 'reach':137C 'recurs':39B,150C 'regular':216C 'remov':142C 'sabnzbd':1A,22B,27B,69B,80C,203C 'sabnzbd.ini':192C 'sabnzbd/api.py':98C 'sabnzbd/filesystem.py':145C 'self':24B 'self-host':23B 'shutil.rmtree':148C 'sourc':84C 'status':131C 'store':188C 'suppli':36B 'system':212C 'tool':31B,88C 'trace':178C 'use':147C 'usenet':26B,29B,86C 'user':35B,102C,217C 'user-control':101C 'user-suppli':34B 'valid':60B,125C,170C 'valu':104C 'version':228C 'without':41B,106C 'writabl':200C 'write':72B","nicknames":[],"mitigations":[],"who_affected":"Any SABnzbd instance before 5.1.0Beta3 whose API can be reached by someone holding a valid API key. Exposure depends on whether the web API is exposed beyond trusted users; instances not reachable by untrusted parties carry less risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T21:17:14+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62965","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62965","severity":null,"published_at":"2026-10-30T21:17:14+00:00","modified_at":"2026-10-30T21:17:14+00:00","first_seen_at":"2026-10-30T21:25:53+00:00","fetched_at":"2026-10-30T21:25:53+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}