A path‑traversal flaw in SABnzbd’s orphan‑job API allows a user controlling the $value parameter to escape the configured download directory and supply an absolute path. When an attacker with a valid API key calls the delete_orphan command, the internal routine uses shutil.rmtree() to recursively delete the target, removing files or directories writable by the SABnzbd process. The vulnerability is identified as CWE‑22 and results in data loss and potential service disruption, but it does not grant system‑level access or data exfiltration.

SABnzbd, the open‑source Usenet downloader, is vulnerable in all releases before version 5.1.0Beta3. The issue is fixed in 5.1.0Beta3 and later.

The CVSS score of 7 indicates a high severity; the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a valid API key, which is stored in plaintext in the sabnzbd.ini file, so an attacker who can obtain the key can trigger the deletion routine via the delete_orphan endpoint. The attack path is straightforward: supply an absolute path, bypass the download directory restriction, invoke delete_orphan, and the process removes any writable file or directory, including configuration files, queue data, and downloads.