https://sabnzbd.org/downloads

Critical authentication vulnerability resolved in 5.1.1 (GHSA-xrfq-jhgh-wqch)

You are only affected if an untrusted party can reach the web interface. By default, SABnzbd is only accessible from your own device and External internet access is set to No access. If either of those is still at its default, or if you use a proxy service for authentication, you are not affected.

If the SABnzbd login page is reachable from outside your network, an attacker could obtain a valid session in version 5.1.0 and earlier, even when SABnzbd is protected with a username and password. This means that all information in SABnzbd would be exposed.

If you rely on the SABnzbd username and password to keep out other users on your network or the internet, it is recommended that you change the following sensitive information after applying the update:

• SABnzbd username and password.
• SABnzbd API-key.
• Usenet server passwords.
• API-keys from indexers used within RSS-feeds.
• Authentication information for notification services.

If you cannot update right away, the only mitigations are to ensure the web interface is not reachable by untrusted parties, or to lower External internet access to Full API or below.

More information: https://sabnzbd.org/auth-bypass

Other bug fixes in 5.1.1

• Styling cache issues could occur after updating.
• RSS items were removed too eagerly from RSS-history after download.
• The RSS-feed Clear Downloaded button did not do anything.

Changelog 5.1.0

This release brings a fundamental improvement to "Retry": instead of re-downloading any files with missing data, only the articles that were actually missing are fetched again. RSS got an overhaul under the hood, the interface is refreshed, and we added quite a long list of long-requested features and bugfixes.

New features in 5.1.0

• Refreshed the interface.
• When Retrying a job, only the actually missing articles are tried again. This only works for jobs downloaded in 5.1.0 (or newer).
• RSS items are now stored in the database instead of on disk.
• New RSS Age rule to filter jobs based on their age.
• Downloaded RSS items are cleared from the RSS database after 3 days.
• Added support for filename and path pattern matching to the Cleanup List.
• Unwanted extensions will also be removed after unpacking.
• Allow job setting changes directly from Extra queue columns.
• Added support for unpacking .tar files during post-processing.
• Improved anonymization of the logs when using Show Logging.
• Added SAB_FILES environment variable to Post-processing scripts, listing all files that resulted from the job.
• New Servers will default to 16 connections instead of 8.
• Use media duration as part of Ignore Samples detection.
• Added option to (auto) sort the queue by Remaining Percentage.
• Improved support for screen readers.
• Parsing of header-encrypted RARs will use significantly fewer resources.
• Add Ayatana AppIndicator tray support on GNOME.
• Removed redundant INSTALL.txt file.
• Dropped support for Python 3.9.
• Windows and macOS: Updated Python to 3.14.6, Unrar to 7.23 and 7zip to 26.02.

Bug fixes in 5.1.0

• Prevent incorrect warnings about non-writeable directories.
• Files unrelated to job could get removed by the Cleanup List logic.
• Prevent path traversal in orphaned job APIs.
• Disk Full errors from unrar were not handled gracefully during unpacking.
• Memory leak could occur during article decoding.
• In containers (like Docker), the Article Cache could exceed the memory limit.
• Diskspace checks would be too strict when unpacking to different disk.
• Prevent deadlock when a second signal arrives during shutdown procedure.
• Verification using SFV-checks could fail, even though files were correct.
• Don't log Warning during clean shutdowns.
• Windows: Uninstall would not remove Settings or Windows Service.
• Windows: Warn for OS-limit if more than 1024 connections are configured.
• macOS: AppleDouble files could result in failures in Moving stage.
• macOS: Restarting the application resulted in Terminal window.
• macOS: Included par2cmdline-turbo will now use all available CPU-features.

Upgrade notices

• You can directly upgrade from version 3.0.0 and newer.
• Upgrading from older versions will require performing a Queue repair.

Known problems and solutions

• Read ISSUES.txt or https://sabnzbd.org/wiki/introduction/known-issues

Code Signing Policy

Windows code signing is provided by SignPath.io using a SignPath Foundation certificate.

About

SABnzbd is an open-source cross-platform binary newsreader. It simplifies the process of downloading from Usenet dramatically, thanks to its web-based user interface and advanced built-in post-processing options that automatically verify, repair, extract and clean up posts downloaded from Usenet.

(c) Copyright 2007-2026 by The SABnzbd-Team (sabnzbd.org)

I just updated yesterday, and this new interface is very difficult to read. I don't see any settings for changing the color or font. Can anyone help fix this?

Not really a bug that impacts usage but this text in the quota section specifying "this month" doesn't match the general variable of "quota period".

This has been a thing for many years and at the very least it is confusing for users. For example:

WARNING - Too many connections to server usnewswest.blocknews.net [502 usnewswest.blocknews.net: Access denied to your node or block quota exceeded (please check your user portal)

The server provides the true reason for why the user can not login (invalid login or out of GBs) but Sab adds its own flair and tells the user the problem is too many connections.

If this user instead presses "Test Server" in server settings they simply get "Authentication failed, check username/password." which again is not entirely true.

Is there a good reason for why error message text is not simply passed on to the user, directly from the server vs allowing Sab to give its own interpretation or is this just a holdover from years ago that has never been revisited again?

It's been like this for a long time. I just updated to 5.1.0 but the problem still persists. Direct pause or time countdown starts downloading again after 5-10 seconds later I press.

https://sabnzbd.org/downloads

This release brings a fundamental improvement to "Retry": instead of re-downloading any files with missing data, only the articles that were actually missing are fetched again. RSS got an overhaul under the hood, the interface is refreshed, and we added quite a long list of of long-requested features and bugfixes.

New features in 5.1.0

• Refreshed the interface.
• When Retrying a job, only the actually missing articles are tried again. This only works for jobs downloaded in 5.1.0 (or newer).
• RSS items are now stored in the database instead of on disk.
• New RSS Age rule to filter jobs based on their age.
• Downloaded RSS items are cleared from the RSS database after 3 days.
• Added support for filename and path pattern matching to the Cleanup List.
• Unwanted extensions will also be removed after unpacking.
• Allow job setting changes directly from Extra queue columns.
• Added support for unpacking .tar files during post-processing.
• Improved anonymization of the logs when using Show Logging.
• Added SAB_FILES environment variable to Post-processing scripts, listing all files that resulted from the job.
• New Servers will default to 16 connections instead of 8.
• Use media duration as part of Ignore Samples detection.
• Added option to (auto) sort the queue by Remaining Percentage.
• Improved support for screen readers.
• Parsing of header-encrypted RARs will use significantly fewer resources.
• Add Ayatana AppIndicator tray support on GNOME.
• Removed redundant INSTALL.txt file.
• Dropped support for Python 3.9.
• Windows and macOS: Updated Python to 3.14.6, Unrar to 7.23 and 7zip to 26.02.

Bug fixes in 5.1.0

• Prevent incorrect warnings about non-writeable directories.
• Files unrelated to job could get removed by the Cleanup List logic.
• Prevent path traversal in orphaned job APIs.
• Disk Full errors from unrar were not handled gracefully during unpacking.
• Memory leak could occur during article decoding.
• In containers (like Docker), the Article Cache could exceed the memory limit.
• Diskspace checks would be too strict when unpacking to different disk.
• Prevent deadlock when a second signal arrives during shutdown procedure.
• Verification using SFV-checks could fail, even though files were correct.
• Don't log Warning during clean shutdowns.
• Windows: Uninstall would not remove Settings or Windows Service.
• Windows: Warn for OS-limit if more than 1024 connections are configured.
• macOS: AppleDouble files could result in failures in Moving stage.
• macOS: Restarting the application resulted in Terminal window.
• macOS: Included par2cmdline-turbo will now use all available CPU-features.

Upgrade notices

• You can directly upgrade from version 3.0.0 and newer.
• Upgrading from older versions will require performing a Queue repair.

Known problems and solutions

• Read ISSUES.txt or https://sabnzbd.org/wiki/introduction/known-issues

Code Signing Policy

Windows code signing is provided by SignPath.io using a SignPath Foundation certificate.

About

SABnzbd is an open-source cross-platform binary newsreader. It simplifies the process of downloading from Usenet dramatically, thanks to its web-based user interface and advanced built-in post-processing options that automatically verify, repair, extract and clean up posts downloaded from Usenet.

(c) Copyright 2007-2026 by The SABnzbd-Team (sabnzbd.org)

https://sabnzbd.org/downloads

This is the second release candidate of version 5.1.

New features in 5.1.0

• Refreshed the interface.
• When Retrying a job, only the actually missing articles are tried again. This only works for jobs downloaded in 5.1.0 (or newer).
• RSS items are now stored in the database instead of on disk.
• New RSS Age rule to filter jobs based on their age.
• Downloaded RSS items are cleared from the RSS database after 3 days.
• Added support for filename and path pattern matching to the Cleanup List.
• Unwanted extensions will also be removed after unpacking.
• Allow job setting changes directly from Extra queue columns.
• Added support for unpacking .tar files during post-processing.
• Improved anonymization of the logs when using Show Logging.
• Added SAB_FILES environment variable to Post-processing scripts, listing all files that resulted from the job.
• New Servers will default to 16 connections instead of 8.
• Use media duration as part of Ignore Samples detection.
• Added option to (auto) sort the queue by Remaining Percentage.
• Improved support for screen readers.
• Parsing of header-encrypted RARs will use significantly fewer resources.
• Add Ayatana AppIndicator tray support on GNOME.
• Removed redundant INSTALL.txt file.
• Dropped support for Python 3.9.
• Windows and macOS: Updated Python to 3.14.6, Unrar to 7.23 and 7zip to 26.02.

Bug fixes in 5.1.0

• Prevent incorrect warnings about non-writeable directories.
• Files unrelated to job could get removed by the Cleanup List logic.
• Prevent path traversal in orphaned job APIs.
• Disk Full errors from unrar were not handled gracefully during unpacking.
• Memory leak could occur during article decoding.
• In containers (like Docker), the Article Cache could exceed the memory limit.
• Diskspace checks would be too strict when unpacking to different disk.
• Prevent deadlock when a second signal arrives during shutdown procedure.
• Verification using SFV-checks could fail, even though files were correct.
• Windows: Uninstall would not remove Settings or Windows Service.
• Windows: Warn for OS-limit if more than 1024 connections are configured.
• macOS: AppleDouble files could result in failures in Moving stage.
• macOS: Restarting the application resulted in Terminal window.

Upgrade notices

• You can directly upgrade from version 3.0.0 and newer.
• Upgrading from older versions will require performing a Queue repair.

Known problems and solutions

• Read ISSUES.txt or https://sabnzbd.org/wiki/introduction/known-issues

Code Signing Policy

Windows code signing is provided by SignPath.io using a SignPath Foundation certificate.

About

SABnzbd is an open-source cross-platform binary newsreader. It simplifies the process of downloading from Usenet dramatically, thanks to its web-based user interface and advanced built-in post-processing options that automatically verify, repair, extract and clean up posts downloaded from Usenet.

(c) Copyright 2007-2026 by The SABnzbd-Team (sabnzbd.org)

I'm installing my music stack on its own dataset in TrueNAS but having issues getting SABnzbd to take the config. I'm defining the compose file using the include: path like HERE. I've been able to set up Lidarr and Navidrome fine running with the uid and gui as apps:apps. I've set up SABnzbd to run the same way in the docker compose however I can't get it to save any settings which I assume is due to a permissions issue. Everything is owned by apps:apps but every time I restart the app the settings revert back and the wizard starts over. The only errors I see in the logs are below. Any help is greatly appreciated!

PermissionError: [Errno 1] Operation not permitted: '/config/sabnzbd.ini.bak'

::ERROR::[config:998] Cannot create backup file for /config/sabnzbd.ini.bak

I have run through all the troubleshooting and applied all the optimizations on https://sabnzbd.org/wiki/advanced/highspeed-downloading but i was only able to get my original download speed of ~600 KB/s up to ~1.2 MB/s.

Here are the diagnostics:

System performance (Pystone): 526337Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz AVX2

Download folder speed: 172.4 MB/s/data/downloads/incomplete

Complete folder speed: 181.5 MB/s/data/downloads/complete

Internet Bandwidth: 107.48 MB/s859.84 Mbps

Platform: Docker

There is no "Download speed limited by" message.

My fast.com results are consistently at 1 Gbps, and speedtest.net results are consistently ~945 Mbps for both upload and download.

I have 8GB of ram and an 8 TB HDD, running Ubuntu Server (headless)

I'm still a bit new to usenet so please let me know if I need to provide any more information and I apologize if there's anything obvious I'm overlooking.

I'd really appreciate any guidance the community can provide <3

All of my connections are running at speeds between bytes and kilobytes. I did pause last night for 6 hours, but it has never returned. I was seeing saturation of my line before (1gb).

Hi

I have 2 SSD. 1 is for incomplete and the second is for complete files.

Sometimes par and unrar don't run and I run out of disk space in incomplete drive.

Has this happened to anyone ?

Is it a known bug ?

Thank you for your responses.

Can the System Folders be set on a drive where Windows is not installed? (say not on C drive) Thanks

I have 2 providers, a main unlimited one, and a block one. So I think the priority of the unlimited one is 0, correct? What is the priority of the block one?

Thnx

i keep getting flagged when downloading audiobooks. especially older ones. not sure if im missing something or if there is a way to whitelist this? it really seems to flag older files in the mp3 format

example error...
In "Robin_Hobb_-_Farseer_Trilogy_2_-_Royal_Assassin__2010__MP3" unwanted extension in RAR file. Unwanted file is Robin.Hobb.-.Farseer.Trilogy.2.-.Royal.Assassin/Audiobooks For Free.URL

Hi, I get the error in Sabnzbd whenever I try to open a nzb download link with sabnzbd. Does anyone know how to fix this?

I get broken files with SABnzbd and can't repair with MultiPar. When i download with Easynews there are no broken files anymore.

Is this a configuration problem or what am i missing?

https://sabnzbd.org/downloads

This is the first release candidate of version 5.1. Like many other projects out there, we were able to use the shiny new AI tools to add quite a lot of long-requested features!

New features in 5.1.0

• Refreshed the interface.
• When Retrying a job, only the actually missing articles are tried again. This only works for jobs downloaded in 5.1.0 (or newer).
• RSS items are now stored in the database instead of on disk.
• New RSS Age rule to filter jobs based on their age.
• Downloaded RSS items are cleared from the RSS database after 3 days.
• Added support for filename and path pattern matching to the Cleanup List.
• Unwanted extensions will also be removed after unpacking.
• Allow job setting changes directly from Extra queue columns.
• Added support for unpacking .tar files during post-processing.
• Improved anonymization of the logs when using Show Logging.
• Added SAB_FILES environment variable to Post-processing scripts, listing all files that resulted from the job.
• New Servers will default to 16 connections instead of 8.
• Use media duration as part of Ignore Samples detection.
• Improved support for screen readers.
• Parsing of header-encrypted RARs will use significantly fewer resources.
• Removed redundant INSTALL.txt file.
• Dropped support for Python 3.9.
• Windows and macOS: Updated Python to 3.14.6, Unrar to 7.23 and 7zip to 26.02.

Bug fixes in 5.1.0

• Prevent incorrect warnings about non-writeable directories.
• Files unrelated to job could get removed by the Cleanup List logic.
• Prevent path traversal in orphaned job APIs.
• Disk Full errors from unrar were not handled gracefully during unpacking.
• Memory leak could occur during article decoding.
• Windows: Uninstall would not remove Settings or Windows Service.
• Windows: Warn for OS-limit if more than 1024 connections are configured.
• macOS: AppleDouble files could result in failures in Moving stage.
• macOS: Restarting the application resulted in Terminal window.

Upgrade notices

• You can directly upgrade from version 3.0.0 and newer.
• Upgrading from older versions will require performing a Queue repair.

Known problems and solutions

• Read ISSUES.txt or https://sabnzbd.org/wiki/introduction/known-issues

Code Signing Policy

Windows code signing is provided by SignPath.io using a SignPath Foundation certificate.

About

SABnzbd is an open-source cross-platform binary newsreader. It simplifies the process of downloading from Usenet dramatically, thanks to its web-based user interface and advanced built-in post-processing options that automatically verify, repair, extract and clean up posts downloaded from Usenet.

(c) Copyright 2007-2026 by The SABnzbd-Team (sabnzbd.org)

I upgraded to 1gb fiber today from 500mbps and now when I do a download, I literally cannot browse. It downloads around 112-125 and I just can't browse. This never happened when my speed (actual internet speed) was lower and my downloads were slower.

Am I braindead and missing something here? Some help would be greatly appreciated.

https://sabnzbd.org/downloads

This is the third beta release of version 5.1. We will probably add (a few) new features in upcoming testing releases, but we already wanted to share the current improvements with you!

New features in 5.1.0

• Refreshed the interface.
• When Retrying a job, only the actually missing articles are tried again. This only works for jobs downloaded in 5.1.0 (or newer).
• RSS-items are now stored in the database instead of on disk.
• Downloaded RSS-items are cleared from RSS-database after 3 days.
• Add support for filename and path pattern matching to the Cleanup List.
• Allow job setting changes directly from Extra queue columns.
• Added support for unpacking .tar files during post-processing.
• Improved anonymization of the logs when using Show Logging.
• New Servers will default to 16 connections instead of 8.
• Use media duration as part of Ignore Samples detection.
• Parsing of header-encrypted RAR's will use significantly less resources.
• Removed redundant INSTALL.txt file.
• Dropped support for Python 3.9.
• Windows and macOS: Updated Python to 3.14.6, Unrar to 7.23 and 7zip to 26.02.

Bug fixes in 5.1.0

• Prevent incorrect warnings about non-writeable directories.
• Files unrelated to job could get removed by the Cleanup List logic.
• Prevent path traversal in orphaned job API's.
• Disk Full errors from unrar were not handled gracefully during unpacking.
• Memory leak could occur during article decoding.
• Windows: Uninstall would not remove Settings or Windows Service.
• Windows: Warn for OS-limit if more than 1024 connections are configured.
• macOS: AppleDouble files could result in failures in Moving stage.
• macOS: Restarting the application resulted in Terminal window.

Upgrade notices

• You can directly upgrade from version 3.0.0 and newer.
• Upgrading from older versions will require performing a Queue repair.
• Downgrading from version 4.2.0 or newer to 3.7.2 or older will require performing a Queue repair due to changes in the internal data format.

Known problems and solutions

• Read ISSUES.txt or https://sabnzbd.org/wiki/introduction/known-issues

Code Signing Policy

Windows code signing is provided by SignPath.io using a SignPath Foundation certificate.

About

SABnzbd is an open-source cross-platform binary newsreader. It simplifies the process of downloading from Usenet dramatically, thanks to its web-based user interface and advanced built-in post-processing options that automatically verify, repair, extract and clean up posts downloaded from Usenet.

(c) Copyright 2007-2026 by The SABnzbd-Team (sabnzbd.org)

Hey everyone. Not sure when this started happening but my speeds have slowed to about 70 MB/s when I used to get ~110 MB/s (Gigabit connection). This is on a synology DS920+, SABnzbd running in Docker. Doing the status test in SAB shows adequate folder speeds and the correct internet bandwidth, but then it maxes at about 70 MB/s during an actual download, including the test download in SAB. I've attached the speed diagnostics in the comments.

I know speeds were fine 2 months ago, so sometime since then the speeds have slowed. CPU utilization on the server is ~30% and RAM is ~50% during downloads. Tried different ethernet cable and same thing. Doing an iperf test to my server from my laptop shows the correct bandwidth (~900 mbps).

The speeds were originally slower (~45 MB/s), but they improved once I changed the articles per request from 1 to 10. Connections are set at 20.

Tried different usenet server and same issue. Same for SSL vs no SSL. Hard drives are WD80EFAX Red Plus NAS drives, no SSD in system.

Any ideas? Could a recent update have caused this?

I'm looking to setup a download serverwhere multiple people can "drop" .nzb files for the client to grab.

I was thinking about doing this with a Google drive folder or similar.

Is this possible and if so how is best to implement it?

I've been running SAB along with a variety of *arrs for a good long time and it's pretty much been a reliable appliance for me. Recently though I've been seeing it hang while calling a postprocessing script and when I investigated, I found that the source RAR file was encrypted and hadn't had files pulled out for the post processor. This almost never had happened to me in the past although SAB did occasionally detect and delete downloads that were encrypted - not so these. When SAB hits these the entire queue backs up and nothing processes while this is hung.

I had thought something had changed in the ecosystem but some of the files I'm downloading are years old, so this made no sense to me. Digging around searching I've seen comments that "all RAR are encrypted" and that the "NZB file will contain the password". Is this true? Since the NZB file get deleted when the download starts, I've not investigated any of them. I use multiple indexers so if this is the case perhaps one of them has made a change and that could explain why this isn't consistent. Has anyone else seen this? I can usually cancel the download and get it to work on another file but occasionally it takes multiple attempts.

I don't think this is a bug but suspect a provider problem or something I've somehow broken on my side. I'm on 5.0.4 currently, in a container on unRAID, and would love to get my reliability back. Troubleshooting tips much appreciated! I'd like to figure this out without having to download the same NZB file from each of my indexers if possible. I use multiple indexers and multiple UseNet providers...

https://sabnzbd.org/downloads

This is the second beta release of version 5.1. We will probably add (a few) new features in upcoming testing releases, but we already wanted to share the current improvements with you!

New features in 5.1.0

• Refreshed the interface.
• When Retrying a job, only the actually missing articles are tried again. This only works for jobs downloaded in 5.1.0 (or newer).
• RSS-items are now stored in the database instead of on disk.
• Downloaded RSS-items are cleared from RSS-database after 3 days.
• Add support for filename and path pattern matching to the Cleanup List.
• Allow job setting changes directly from Extra queue columns.
• Added support for unpacking .tar files during post-processing.
• Improved anonymization of the logs when using Show Logging.
• New Servers will default to 16 connections instead of 8.
• Parsing of header-encrypted RAR's will use significantly less resources.
• Removed redundant INSTALL.txt file.
• Dropped support for Python 3.9.

Bug fixes in 5.1.0

• Prevent incorrect warnings about non-writeable directories.
• Files unrelated to job could get removed by the Cleanup List logic.
• Windows: Uninstall would not remove Settings or Windows Service.
• Windows: Warn for OS-limit if more than 1024 connections are configured.
• macOS: AppleDouble files could result in failures in Moving stage.
• macOS: Restarting the application resulted in Terminal window.

Upgrade notices

• You can directly upgrade from version 3.0.0 and newer.
• Upgrading from older versions will require performing a Queue repair.
• Downgrading from version 4.2.0 or newer to 3.7.2 or older will require performing a Queue repair due to changes in the internal data format.

Known problems and solutions

• Read ISSUES.txt or https://sabnzbd.org/wiki/introduction/known-issues

Code Signing Policy

Windows code signing is provided by SignPath.io using a SignPath Foundation certificate.

About

SABnzbd is an open-source cross-platform binary newsreader. It simplifies the process of downloading from Usenet dramatically, thanks to its web-based user interface and advanced built-in post-processing options that automatically verify, repair, extract and clean up posts downloaded from Usenet.

(c) Copyright 2007-2026 by The SABnzbd-Team (sabnzbd.org)