UBUNTU-CVE-2026-62965: High severity ubuntu/sabnzbdplus vulnerability
SABnzbd is an open source automated Usenet download tool. Prior to 5.1.0Beta3, orphan-job management in sabnzbd/api.py accepts the user-controlled value parameter without path confinement before os.path.join() with downloaddir. An absolute path discards that base directory. An attacker with a valid API key can invoke mode=status with name=deleteorphan to reach apideleteorphan and removeall() in sabnzbd/filesystem.py, which uses shutil.rmtree() for recursive deletion. The advisory also identifies apiaddorphan and apideleteallorphan as affected by the path-validation issue, while its concrete arbitrary-deletion trace is through apideleteorphan. The API key is stored in plaintext in sabnzbd.ini. The attacker can delete files or directories writable by the SABnzbd process, including configuration, queue data, and downloads, but system files outside the regular user's ownership are not affected. This issue is fixed in version 5.1.0Beta3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SABnzbdto a version that resolves this vulnerability.Fixed in 5.1.0Beta3
Event History
Frequently Asked Questions
Who can exploit this issue, and what access do they need?
An attacker needs a valid SABnzbd API key and network access to the API. The key is stored in plaintext in sabnzbd.ini, so anyone able to read that file may be able to use it.
What can an attacker delete?
The attacker can recursively delete files and directories writable by the SABnzbd process, including its configuration, queue data, and downloads. Files outside the regular user's ownership, such as system files, are not affected.
Which API action is associated with the confirmed arbitrary-deletion path?
The concrete deletion path uses mode=status with name=delete_orphan and reaches _api_delete_orphan, which ultimately calls shutil.rmtree(). The advisory also identifies _api_add_orphan and _api_delete_all_orphan as affected by the path-validation issue.
What should be done if the installation cannot be updated immediately?
Restrict access to the SABnzbd API and protect sabnzbd.ini because its plaintext API key is sufficient to invoke the vulnerable endpoint. Ensure the SABnzbd process has write access only to directories whose deletion impact is acceptable.
What version contains the fix?
The issue is fixed in SABnzbd version 5.1.0Beta3.