Description
SABnzbd is an open source binary newsreader. A vulnerability was discovered in SABnzbd that could trick the `filesystem.renamer()` function into writing downloaded files outside the configured Download Folder via malicious PAR2 files. A patch was released as part of SABnzbd 3.2.1RC1. As a workaround, limit downloads to NZBs without PAR2 files, deny write permissions to the SABnzbd process outside areas it must access to perform its job, or update to a fixed version.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| sabnzbd | sabnzbd | < 3.0.0, < 3.2.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | sabnzbdplus | 3.2.1+dfsg-1 | — |
| Debian 13 | sabnzbdplus | 3.2.1+dfsg-1 | — |
| Debian 12 | sabnzbdplus | 3.2.1+dfsg-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | sabnzbdplus | No fix yet | — |
| Ubuntu 20.04 LTS | sabnzbdplus | No fix yet | — |
| Ubuntu 18.04 LTS | sabnzbdplus | No fix yet | — |
| Ubuntu 16.04 LTS | sabnzbdplus | No fix yet | — |