Path Traversal Vulnerability in SABnzbd Open Source Download Tool

CVE-2026-62965

What is CVE-2026-62965?

SABnzbd, an open source automated Usenet download tool, has a vulnerability in its orphan-job management system. An attacker who has a valid API key can exploit this flaw, allowing unauthorized deletion of files that are writable by the SABnzbd process. This includes potentially sensitive configuration files, queue data, and download directories. The attack leverages the inadequate path confinement of user-controlled parameters before invoking file operations, specifically through the _api_delete_orphan endpoint. The issue, which is fixed in version 5.1.0Beta3, underscores the importance of proper input validation and secure management of sensitive data.

References