CVE-2026-62965: SABnzbd: Orphan-job path traversal permits arbitrary file deletion

SABnzbd is an open source automated Usenet download tool. Prior to 5.1.0Beta3, orphan-job management in sabnzbd/api.py accepts the user-controlled value parameter without path confinement before os.path.join() with downloaddir. An absolute path discards that base directory. An attacker with a valid API key can invoke mode=status with name=deleteorphan to reach apideleteorphan and removeall() in sabnzbd/filesystem.py, which uses shutil.rmtree() for recursive deletion. The advisory also identifies apiaddorphan and apideleteallorphan as affected by the path-validation issue, while its concrete arbitrary-deletion trace is through apideleteorphan. The API key is stored in plaintext in sabnzbd.ini. The attacker can delete files or directories writable by the SABnzbd process, including configuration, queue data, and downloads, but system files outside the regular user's ownership are not affected. This issue is fixed in version 5.1.0Beta3.