CVE-2023-34237

SABnzbd is an open source automated Usenet download tool. A design flaw was
discovered in SABnzbd that could allow remote code execution. Manipulating
the Parameters setting in the Notification Script functionality allows code
execution with the privileges of the SABnzbd process. Exploiting the
vulnerabilities requires access to the web interface. Remote exploitation
is possible if users[exposed their setup to the internet or other untrusted
networks without setting a username/password. By default SABnzbd is only
accessible from localhost, with no authentication required for the web
interface. This issue has been patched in commits e3a722 and 422b4f
which have been included in the 4.0.2 release. Users are advised to
upgrade. Users unable to upgrade should ensure that a username and password
have been set if their instance is web accessible.