CVE-2026-62965

SABnzbd is an open source automated Usenet download tool. Prior to 5.1.0Beta3, orphan-job management in `sabnzbd/api.py` accepts the user-controlled `value` parameter without path confinement before `os.path.join()` with `download_dir`. An absolute path discards that base directory. An attacker with a valid API key can invoke `mode=status` with `name=delete_orphan` to reach `_api_delete_orphan` and `remove_all()` in `sabnzbd/filesystem.py`, which uses `shutil.rmtree()` for recursive deletion. The advisory also identifies `_api_add_orphan` and `_api_delete_all_orphan` as affected by the path-validation issue, while its concrete arbitrary-deletion trace is through `_api_delete_orphan`. The API key is stored in plaintext in `sabnzbd.ini`. The attacker can delete files or directories writable by the SABnzbd process, including configuration, queue data, and downloads, but system files outside the regular user's ownership are not affected. This issue is fixed in version 5.1.0Beta3.

• CWE-22

• https://github.com/sabnzbd/sabnzbd/commit/e3e7fcf361eaebec2d76397b3d27f854f8266410
• https://github.com/sabnzbd/sabnzbd/releases/tag/5.1.0Beta3
• https://github.com/sabnzbd/sabnzbd/security/advisories/GHSA-hxwh-mmrg-p8f5

Published

Oct 30, 2026

Last Modified

Oct 30, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-6295The WP Optimizer plugin for WordPress is vulnerable to SQL I…4.9
• CVE-2026-62958libriscv is a RISC-V sandbox and emulator. Prior to 1.18, a …7.9
• CVE-2026-62959Coturn is a free open source implementation of TURN and STUN…8.2
• CVE-2026-6296Heap buffer overflow in ANGLE in Google Chrome prior to 147.…9.6
• CVE-2026-62960Git for Windows is the Windows port of Git. Prior to 2.55.0.…7.4
• CVE-2026-62963Centrifugo is an open-source scalable real-time messaging se…8.7
• CVE-2026-62966ESPAsyncWebServer is an asynchronous HTTP and WebSocket serv…7.5
• CVE-2026-62967ZTNET is a ZeroTier web UI for private controllers with mult…8.1
• CVE-2026-62968Dream Displays provides in-game screens for streaming videos…8.7
• CVE-2026-6297Use after free in Proxy in Google Chrome prior to 147.0.7727…8.3
• CVE-2026-62979jack lets users share media libraries through their Radarr/S…8.4
• CVE-2026-6298Heap buffer overflow in Skia in Google Chrome prior to 147.0…4.3