What’s Vulnerable › Vulnerabilities

CVE-2021-29488: Creation of files outside the Download Folder through malicious PAR2 files

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-05-07 · updated 2026-06-17
• Weakness: CWE-23

Description

SABnzbd is an open source binary newsreader. A vulnerability was discovered in SABnzbd that could trick the `filesystem.renamer()` function into writing downloaded files outside the configured Download Folder via malicious PAR2 files. A patch was released as part of SABnzbd 3.2.1RC1. As a workaround, limit downloads to NZBs without PAR2 files, deny write permissions to the SABnzbd process outside areas it must access to perform its job, or update to a fixed version.

Affected products

• sabnzbd: before 3.0.0; before 3.2.1 — fixed in 3.0.0, 3.2.1

How to fix

Upgrade to a fixed version: sabnzbd 3.0.0, 3.2.1. Check the vendor advisory for mitigations.

References

• https://github.com/sabnzbd/sabnzbd/security/advisories/GHSA-jwj3-wrvf-v3rp
• https://github.com/sabnzbd/sabnzbd/security/advisories/GHSA-jwj3-wrvf-v3rp

Get alerted when CVE-2021-29488 or the next vulnerability affects your stack