CVE-2023-49102

PoC —

CVSS 3.1

8.8 high

EPSS

2%p73

Published

Nov 22, 2023 (Nov 22, 2023)

Modified

Jun 17, 2026

Description

NZBGet 21.1 allows authenticated remote code execution because the unarchive programs (7za and unrar) preserve executable file permissions. An attacker with the Control capability can execute a file by setting the value of SevenZipCommand or UnrarCmd. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Vendors: nzbget
Products: nzbget
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.5%)

In the news0 stories

No ingested article mentions this CVE yet.