{"id":"DEBIAN-CVE-2026-62965","details":"SABnzbd is an open source automated Usenet download tool. Prior to 5.1.0Beta3, orphan-job management in `sabnzbd/api.py` accepts the user-controlled `value` parameter without path confinement before `os.path.join()` with `download_dir`. An absolute path discards that base directory. An attacker with a valid API key can invoke `mode=status` with `name=delete_orphan` to reach `_api_delete_orphan` and `remove_all()` in `sabnzbd/filesystem.py`, which uses `shutil.rmtree()` for recursive deletion. The advisory also identifies `_api_add_orphan` and `_api_delete_all_orphan` as affected by the path-validation issue, while its concrete arbitrary-deletion trace is through `_api_delete_orphan`. The API key is stored in plaintext in `sabnzbd.ini`. The attacker can delete files or directories writable by the SABnzbd process, including configuration, queue data, and downloads, but system files outside the regular user's ownership are not affected. This issue is fixed in version 5.1.0Beta3.","modified":"2026-10-31T10:01:21.038141107Z","published":"2026-10-30T21:17:14.993Z","upstream":["CVE-2026-62965"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2026-62965"}],"affected":[{"package":{"name":"sabnzbdplus","ecosystem":"Debian:12","purl":"pkg:deb/debian/sabnzbdplus?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.11-1","0.4.12-1","0.4.9-1","0.5.0-1","0.5.0-2","0.5.2-1","0.5.3-1","0.5.4-1","0.5.5-1","0.5.6-1","0.6.10-1","0.6.14-1","0.6.15-1","0.6.2-1","0.6.4-1","0.6.6-1","0.6.7-1","0.6.8-1","0.6.9-1","0.7.11-1","0.7.13-1","0.7.16-1","0.7.18-1","0.7.2-1","0.7.20+dfsg-1","0.7.20-1","0.7.3-1","0.7.4-1","0.7.5-1","0.7.6-1","0.7.8-1","0.7.9-1","1.0.2+dfsg-1","1.0.3+dfsg-1","1.0.3+dfsg-2","1.1.1+dfsg-1","2.3.1+dfsg-1","2.3.2+dfsg-1","2.3.4+dfsg-1","2.3.6+dfsg-1","3.0.0~0git20200408+dfsg-1","3.1.1+dfsg-1","3.1.1+dfsg-2","3.2.1+dfsg-1","3.3.1+dfsg-1","3.4.2+dfsg-1","3.4.2+dfsg-2","3.5.0+dfsg-1","3.5.0+dfsg-2","3.5.1+dfsg-1","3.5.3+dfsg-1","3.6.0+dfsg-1","3.6.0+dfsg-2","3.6.1+dfsg-1","3.7.0+dfsg-1","3.7.1+dfsg-1","3.7.1+dfsg-1~bpo11+1","3.7.1+dfsg-2","4.0.2+dfsg-1","4.1.0+dfsg-1","4.1.0+dfsg-1~bpo11+1","4.1.0+dfsg-1~bpo12+1","4.2.2+dfsg-1","4.2.2+dfsg-1~bpo11+1","4.2.2+dfsg-1~bpo12+1","4.2.2+dfsg-2","4.2.2+dfsg-3","4.2.2+dfsg-4","4.2.3+dfsg-1","4.2.3+dfsg-1~bpo11+1","4.2.3+dfsg-1~bpo12+1","4.3.2+dfsg-1","4.3.2+dfsg-1~bpo11+1","4.3.2+dfsg-1~bpo12+1","4.3.3+dfsg-1","4.3.3+dfsg-1~bpo12+1","4.4.0+dfsg-1","4.4.0+dfsg-1~bpo12+1","4.4.1+dfsg-1","4.4.1+dfsg-1~bpo12+1","4.4.1+dfsg-2","4.5.0+dfsg-1","4.5.0+dfsg-1~bpo12+1","4.5.2+dfsg-1","4.5.2+dfsg-1~bpo12+1","4.5.2+dfsg-1~bpo13+1","4.5.4+dfsg-1","4.5.4+dfsg-1~bpo12+1","4.5.4+dfsg-1~bpo13+1","4.5.4+dfsg-2","4.5.4+dfsg-3","4.5.4+dfsg-3~bpo12+1","4.5.4+dfsg-3~bpo13+1","4.5.4+dfsg-4","5.0.3+dfsg-1","5.0.3+dfsg-1~bpo12+1","5.0.3+dfsg-1~bpo13+1","5.0.3+dfsg-2","5.0.3+dfsg-3","5.0.4+dfsg-1","5.0.4+dfsg-1~bpo13+1","5.1.1+dfsg-1","5.1.1+dfsg-1~bpo13+1","5.1.2+dfsg-1","5.1.2+dfsg-1~bpo13+1","5.1.3+dfsg-1","5.1.3+dfsg-1~bpo13+1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-62965.json"}},{"package":{"name":"sabnzbdplus","ecosystem":"Debian:13","purl":"pkg:deb/debian/sabnzbdplus?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.11-1","0.4.12-1","0.4.9-1","0.5.0-1","0.5.0-2","0.5.2-1","0.5.3-1","0.5.4-1","0.5.5-1","0.5.6-1","0.6.10-1","0.6.14-1","0.6.15-1","0.6.2-1","0.6.4-1","0.6.6-1","0.6.7-1","0.6.8-1","0.6.9-1","0.7.11-1","0.7.13-1","0.7.16-1","0.7.18-1","0.7.2-1","0.7.20+dfsg-1","0.7.20-1","0.7.3-1","0.7.4-1","0.7.5-1","0.7.6-1","0.7.8-1","0.7.9-1","1.0.2+dfsg-1","1.0.3+dfsg-1","1.0.3+dfsg-2","1.1.1+dfsg-1","2.3.1+dfsg-1","2.3.2+dfsg-1","2.3.4+dfsg-1","2.3.6+dfsg-1","3.0.0~0git20200408+dfsg-1","3.1.1+dfsg-1","3.1.1+dfsg-2","3.2.1+dfsg-1","3.3.1+dfsg-1","3.4.2+dfsg-1","3.4.2+dfsg-2","3.5.0+dfsg-1","3.5.0+dfsg-2","3.5.1+dfsg-1","3.5.3+dfsg-1","3.6.0+dfsg-1","3.6.0+dfsg-2","3.6.1+dfsg-1","3.7.0+dfsg-1","3.7.1+dfsg-1","3.7.1+dfsg-1~bpo11+1","3.7.1+dfsg-2","4.0.2+dfsg-1","4.1.0+dfsg-1","4.1.0+dfsg-1~bpo11+1","4.1.0+dfsg-1~bpo12+1","4.2.2+dfsg-1","4.2.2+dfsg-1~bpo11+1","4.2.2+dfsg-1~bpo12+1","4.2.2+dfsg-2","4.2.2+dfsg-3","4.2.2+dfsg-4","4.2.3+dfsg-1","4.2.3+dfsg-1~bpo11+1","4.2.3+dfsg-1~bpo12+1","4.3.2+dfsg-1","4.3.2+dfsg-1~bpo11+1","4.3.2+dfsg-1~bpo12+1","4.3.3+dfsg-1","4.3.3+dfsg-1~bpo12+1","4.4.0+dfsg-1","4.4.0+dfsg-1~bpo12+1","4.4.1+dfsg-1","4.4.1+dfsg-1~bpo12+1","4.4.1+dfsg-2","4.5.0+dfsg-1","4.5.0+dfsg-1+deb13u1","4.5.0+dfsg-1+deb13u2","4.5.0+dfsg-1~bpo12+1","4.5.2+dfsg-1","4.5.2+dfsg-1~bpo12+1","4.5.2+dfsg-1~bpo13+1","4.5.4+dfsg-1","4.5.4+dfsg-1~bpo12+1","4.5.4+dfsg-1~bpo13+1","4.5.4+dfsg-2","4.5.4+dfsg-3","4.5.4+dfsg-3~bpo12+1","4.5.4+dfsg-3~bpo13+1","4.5.4+dfsg-4","5.0.3+dfsg-1","5.0.3+dfsg-1~bpo12+1","5.0.3+dfsg-1~bpo13+1","5.0.3+dfsg-2","5.0.3+dfsg-3","5.0.4+dfsg-1","5.0.4+dfsg-1~bpo13+1","5.1.1+dfsg-1","5.1.1+dfsg-1~bpo13+1","5.1.2+dfsg-1","5.1.2+dfsg-1~bpo13+1","5.1.3+dfsg-1","5.1.3+dfsg-1~bpo13+1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-62965.json"}},{"package":{"name":"sabnzbdplus","ecosystem":"Debian:14","purl":"pkg:deb/debian/sabnzbdplus?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1+dfsg-1"}]}],"versions":["0.4.11-1","0.4.12-1","0.4.9-1","0.5.0-1","0.5.0-2","0.5.2-1","0.5.3-1","0.5.4-1","0.5.5-1","0.5.6-1","0.6.10-1","0.6.14-1","0.6.15-1","0.6.2-1","0.6.4-1","0.6.6-1","0.6.7-1","0.6.8-1","0.6.9-1","0.7.11-1","0.7.13-1","0.7.16-1","0.7.18-1","0.7.2-1","0.7.20+dfsg-1","0.7.20-1","0.7.3-1","0.7.4-1","0.7.5-1","0.7.6-1","0.7.8-1","0.7.9-1","1.0.2+dfsg-1","1.0.3+dfsg-1","1.0.3+dfsg-2","1.1.1+dfsg-1","2.3.1+dfsg-1","2.3.2+dfsg-1","2.3.4+dfsg-1","2.3.6+dfsg-1","3.0.0~0git20200408+dfsg-1","3.1.1+dfsg-1","3.1.1+dfsg-2","3.2.1+dfsg-1","3.3.1+dfsg-1","3.4.2+dfsg-1","3.4.2+dfsg-2","3.5.0+dfsg-1","3.5.0+dfsg-2","3.5.1+dfsg-1","3.5.3+dfsg-1","3.6.0+dfsg-1","3.6.0+dfsg-2","3.6.1+dfsg-1","3.7.0+dfsg-1","3.7.1+dfsg-1","3.7.1+dfsg-1~bpo11+1","3.7.1+dfsg-2","4.0.2+dfsg-1","4.1.0+dfsg-1","4.1.0+dfsg-1~bpo11+1","4.1.0+dfsg-1~bpo12+1","4.2.2+dfsg-1","4.2.2+dfsg-1~bpo11+1","4.2.2+dfsg-1~bpo12+1","4.2.2+dfsg-2","4.2.2+dfsg-3","4.2.2+dfsg-4","4.2.3+dfsg-1","4.2.3+dfsg-1~bpo11+1","4.2.3+dfsg-1~bpo12+1","4.3.2+dfsg-1","4.3.2+dfsg-1~bpo11+1","4.3.2+dfsg-1~bpo12+1","4.3.3+dfsg-1","4.3.3+dfsg-1~bpo12+1","4.4.0+dfsg-1","4.4.0+dfsg-1~bpo12+1","4.4.1+dfsg-1","4.4.1+dfsg-1~bpo12+1","4.4.1+dfsg-2","4.5.0+dfsg-1","4.5.0+dfsg-1~bpo12+1","4.5.2+dfsg-1","4.5.2+dfsg-1~bpo12+1","4.5.2+dfsg-1~bpo13+1","4.5.4+dfsg-1","4.5.4+dfsg-1~bpo12+1","4.5.4+dfsg-1~bpo13+1","4.5.4+dfsg-2","4.5.4+dfsg-3","4.5.4+dfsg-3~bpo12+1","4.5.4+dfsg-3~bpo13+1","4.5.4+dfsg-4","5.0.3+dfsg-1","5.0.3+dfsg-1~bpo12+1","5.0.3+dfsg-1~bpo13+1","5.0.3+dfsg-2","5.0.3+dfsg-3","5.0.4+dfsg-1","5.0.4+dfsg-1~bpo13+1","5.1.1+dfsg-1~bpo13+1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-62965.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}]}