CVE-2021-29488: sabnzbd, обхождане на път

Описание

Оригинално описание

SABnzbd is an open source binary newsreader. A vulnerability was discovered in SABnzbd that could trick the `filesystem.renamer()` function into writing downloaded files outside the configured Download Folder via malicious PAR2 files. A patch was released as part of SABnzbd 3.2.1RC1. As a workaround, limit downloads to NZBs without PAR2 files, deny write permissions to the SABnzbd process outside areas it must access to perform its job, or update to a fixed version.

Засегнати продукти

• sabnzbd sabnzbd: < 3.0.0
• sabnzbd sabnzbd: < 3.2.1

Вид слабост

• CWE-23 Обхождане на директории чрез относителен път

История

Други уязвимости в sabnzbd sabnzbd

• 7.0CVE-2026-62965
• 8.1CVE-2023-34237

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2021-29488
• https://nvd.nist.gov/vuln/detail/CVE-2021-29488
• https://github.com/sabnzbd/sabnzbd/security/advisories/GHSA-jwj3-wrvf-v3rp