CVE-2021-29488

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

SABnzbd is an open source binary newsreader. A vulnerability was discovered in SABnzbd that could trick the `filesystem.renamer()` function into writing downloaded files outside the configured Download Folder via malicious PAR2 files. A patch was released as part of SABnzbd 3.2.1RC1. As a workaround, limit downloads to NZBs without PAR2 files, deny write permissions to the SABnzbd process outside areas it must access to perform its job, or update to a fixed version.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-23

Affected software

No affected versions have been published.

Timeline

Published: May 7, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-294895.4Highcharts JS is a JavaScript charting library based on SVG. In Highcharts versions 8 and earlier, the chart options structure was not syste CVE-2021-294905.8Jellyfin is a free software media system that provides media from a dedicated server to end-user devices via multiple apps. Verions prior to CVE-2021-294928.3Envoy is a cloud-native edge/middle/service proxy. Envoy does not decode escaped slash sequences `%2F` and `%5C` in HTTP URL paths in versio CVE-2021-294938.8Kennnyshiwa-cogs contains cogs for Red Discordbot. An RCE exploit has been found in the Tickets module of kennnyshiwa-cogs. This exploit all CVE-2021-294957.5Nim is a statically typed compiled systems programming language. In Nim standard library before 1.4.2, httpClient SSL/TLS certificate verifi CVE-2021-294997.5SIF is an open source implementation of the Singularity Container Image Format. The `siftool new` command and func siftool.New() produce pre CVE-2021-295007.5bubble fireworks is an open source java package relating to Spring Framework. In bubble fireworks before version 2021.BUILD-SNAPSHOT there i CVE-2021-295016.5Ticketer is a command based ticket system cog (plugin) for the red discord bot. A vulnerability allowing discord users to expose sensitive i CVE-2021-295026.5WarnSystem is a cog (plugin) for the Red discord bot. A vulnerability has been found in the code that allows any user to access sensible inf CVE-2021-295036.1HedgeDoc is a platform to write and share markdown. HedgeDoc before version 1.8.2 is vulnerable to a cross-site scripting attack using the Y CVE-2021-295047.4WP-CLI is the command-line interface for WordPress. An improper error handling in HTTPS requests management in WP-CLI version 0.12.0 and lat CVE-2021-295058.8XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remo