CVE-2023-34237

HighCVSS 8.1

Published: 07/06/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.73%

75th percentile - higher than 75% of all known CVEs

Summary

A design flaw was discovered in SABnzbd that could allow remote code execution. Manipulating the Parameters setting in the Notification Script functionality allows code execution with the privileges of the SABnzbd process.

Risk Assessment

Organizations are at risk of remote code execution, especially if their instances are exposed to the internet without proper authentication. Without safeguards, attackers could gain full access to the system.

Recommendation

It is recommended to upgrade to version 4.0.2, which includes patches. Users unable to upgrade should ensure that a username and password are set to secure access to the web interface.

Other vulnerabilities in SABnzbd

CVE-2026-62965High
SABnzbd before version 5.1.0Beta3 allows an attacker with a valid API key to invoke orphan job deletion with a path parameter that is not confined to the download directory. An absolute path can cause recursive deletion of files or directories writable by the SABnzbd process. The API key is stored in plaintext in the configuration file.

Original NVD description (English source)

SABnzbd is an open source automated Usenet download tool. A design flaw was discovered in SABnzbd that could allow remote code execution. Manipulating the Parameters setting in the Notification Script functionality allows code execution with the privileges of the SABnzbd process. Exploiting the vulnerabilities requires access to the web interface. Remote exploitation is possible if users[exposed their setup to the internet or other untrusted networks without setting a username/password. By default SABnzbd is only accessible from `localhost`, with no authentication required for the web interface. This issue has been patched in commits `e3a722` and `422b4f` which have been included in the 4.0.2 release. Users are advised to upgrade. Users unable to upgrade should ensure that a username and password have been set if their instance is web accessible.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS