Hi,

two further vulnerabilities were discovered in sabnzbd that allow
unauthenticated API access respectively remote code execution. Both
issues are fixed in upstream release 5.1.3. No CVEs have been issued
yet.

* __wrapped__ dispatch bypass allows unauthenticated API access.
https://github.com/sabnzbd/sabnzbd/security/advisories/GHSA-q326-jpxx-jmjc

* PAR2 symlink bypass allows pickle remote code execution.
https://github.com/sabnzbd/sabnzbd/security/advisories/GHSA-mjwj-v5mr-cmcg


Upstream provides an overview of all the recent vulnerability at
https://sabnzbd.org/wiki/extra/5.1-vulnerabilities.html

I'll upload the new upstream release to unstable today, and intend to
prepare patches for backports and older Debian releases as soon as
possible.

We believe that the bug you reported is fixed in the latest version of
sabnzbdplus, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1147154@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Jeroen Ploemen <jcfp@debian.org> (supplier of updated sabnzbdplus package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 08 Sep 2026 13:33:24 +0000
Source: sabnzbdplus
Built-For-Profiles: noudeb
Architecture: source
Version: 5.1.3+dfsg-1
Distribution: unstable
Urgency: medium
Maintainer: Jeroen Ploemen <jcfp@debian.org>
Changed-By: Jeroen Ploemen <jcfp@debian.org>
Closes: 1147154
Changes:
 sabnzbdplus (5.1.3+dfsg-1) unstable; urgency=medium
 .
   * New upstream release:
     + fixes a further two vulnerabilities. (Closes: #1147154)
   * Patches: refresh 02.
   * Patches: add 90 to avoid an error on the salsa CI.
Checksums-Sha1:
 28216d8eaf1d30602a2dad73c7e4f99cd5b538bd 2310 sabnzbdplus_5.1.3+dfsg-1.dsc
 716a4b022ce0f2ee5ecc07f7f628595cf81de476 5920196 sabnzbdplus_5.1.3+dfsg.orig.tar.gz
 5bc81716486b5de11019495b8da441e631462cf2 30528 sabnzbdplus_5.1.3+dfsg-1.debian.tar.xz
 22eb8a97a1d24dfefd63d06feb808e333f9cb433 8228 sabnzbdplus_5.1.3+dfsg-1_source.buildinfo
Checksums-Sha256:
 1ba269e653cd71746bf7bbea8b140d9b1face49eb9d4417f125244853629978e 2310 sabnzbdplus_5.1.3+dfsg-1.dsc
 3325a7dd4e899e79d1007324cbe7209ca24c345679e4889fa8683772f3ef3483 5920196 sabnzbdplus_5.1.3+dfsg.orig.tar.gz
 9ac99f0f49398758a1716aac5d28db188f3a636ac3577e7e8d600cd0d5d9f28f 30528 sabnzbdplus_5.1.3+dfsg-1.debian.tar.xz
 7fe533c0c54eb11ce35861745d26620e5e92dc0eac76e86c690429fbb2b6c01a 8228 sabnzbdplus_5.1.3+dfsg-1_source.buildinfo
Files:
 8be19a695ca2c966c29dc134783eaf17 2310 contrib/net - sabnzbdplus_5.1.3+dfsg-1.dsc
 bd46684c12581c9c369402d795056587 5920196 contrib/net - sabnzbdplus_5.1.3+dfsg.orig.tar.gz
 2d08034c75424aba73bf661e8ff16fc4 30528 contrib/net - sabnzbdplus_5.1.3+dfsg-1.debian.tar.xz
 521e586c4e9002ba03d7dd52b92374af 8228 contrib/net - sabnzbdplus_5.1.3+dfsg-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEd8lhnEnWos3N8v+qQoMEoXSNzHoFAmqgDrQACgkQQoMEoXSN
zHpi+A//fN1GvY0c2rqZpNXEb8ETJvYSU7x2fLDTfuXLsNvC5TaVfmIlutTW/0eM
iGxw4KvpHBTwK5T7c80Zhszpt9NL6bj5ywDvolFPy4/axpwIweRP07kB2XCSP2ol
shkMZVFq7Fm4WjzBHhBKY6c9Cb8dz/z0PP+JlQbLq2wu2ULRh0rL11UGO+0eBfYH
E+tkOWty0tcv7CRaRTdJU+YJMFs/TtwHH6JkuUe5hYZhaXB6SyhREpM90LatORee
Aeyw6jr+1U5ybnq8ubPR/0L+cDqJFUnSoYmc/662wp4H9mM5R4JdGwq65I+VIps/
o55hxBuIvefTQp4+A5J+cUMe4UuQLrh6yJxUITRXD2Skspbxl6wdmiN5UIWqKFVZ
0JIYqYD0sxY/zy6Wl96PHE9/tB5yd9wtQ8zRtDqXEHpJ1fuShosv1HK0fx5BB27d
iDxiszXommuzidWSvuP/KqmQRcWOO0GPUk7wiqeB4pJwh1dmaha1BvgXQ6lZe9Zp
7YJ5UWjKNbUwA5+SSp7saBwlU0/Plwt5YJPP8MB2QoWo0xw5wKBmSTMIC7V3P8PX
pf5ibcU5fVZfKivt/6ChBnvYJn5sT32z9VeizRgyZu28JBjfJJRual99sMW3MyyM
h6ayCqnKi5HON13SFctu13hJJfnrP+XF30whGGuLkZgwVpTR158=
=iMoZ
-----END PGP SIGNATURE-----