Is CVE-2021-29488 actively exploited?

No active exploitation of CVE-2021-29488 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2021-29488 be exploited remotely?

Yes. CVE-2021-29488 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2021-29488?

CVE-2021-29488 has a CVSS score of 5.3 (MEDIUM).

HOME VULNERABILITIESCVE-2021-29488

MEDIUM

CVE-2021-29488

CWE-23Published: May 7, 2021· Updated: Jun 17, 2026

5.3

CVSS v3.1

Official Description

SABnzbd is an open source binary newsreader. A vulnerability was discovered in SABnzbd that could trick the `filesystem.renamer()` function into writing downloaded files outside the configured Download Folder via malicious PAR2 files. A patch was released as part of SABnzbd 3.2.1RC1. As a workaround, limit downloads to NZBs without PAR2 files, deny write permissions to the SABnzbd process outside areas it must access to perform its job, or update to a fixed version.

NVD Source

Technical Analysis

CVE-2021-29488 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.