# SABnzbd 5.1.1 — SABnzbd 5.1.1

- Product: SABnzbd (https://whatsnew.fyi/product/sabnzbd)
- Vendor: SABnzbd
- Date: 2026-08-18
- Version: 5.1.1
- Original notes: https://github.com/sabnzbd/sabnzbd/releases/tag/5.1.1
- Permalink: https://whatsnew.fyi/product/sabnzbd/releases/5.1.1

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Fixed critical authentication vulnerability that allowed attackers to obtain valid sessions and access sensitive information when the web interface was reachable from outside the network
- **fixed** — Styling cache issues that could occur after updating
- **fixed** — RSS items were removed too eagerly from RSS-history after download
- **fixed** — The RSS-feed Clear Downloaded button did not do anything
- **added** — Refreshed the interface
- **changed** — When retrying a job, only the actually missing articles are tried again instead of re-downloading all files with missing data
- **added** — RSS items are now stored in the database instead of on disk
- **added** — New RSS Age rule to filter jobs based on their age
- **added** — Downloaded RSS items are cleared from the RSS database after 3 days
- **added** — Added support for filename and path pattern matching to the Cleanup List
- **changed** — Unwanted extensions will also be removed after unpacking
- **added** — Allow job setting changes directly from Extra queue columns
- **added** — Added support for unpacking .tar files during post-processing
- **changed** — Improved anonymization of the logs when using Show Logging
- **added** — Added SAB_FILES environment variable to Post-processing scripts, listing all files that resulted from the job
- **changed** — New Servers will default to 16 connections instead of 8
- **changed** — Use media duration as part of Ignore Samples detection
- **added** — Added option to auto sort the queue by Remaining Percentage
- **changed** — Improved support for screen readers
- **changed** — Parsing of header-encrypted RARs will use significantly fewer resources
- **added** — Add Ayatana AppIndicator tray support on GNOME
- **removed** — Dropped support for Python 3.9
- **fixed** — Prevent incorrect warnings about non-writeable directories
- **fixed** — Files unrelated to job could get removed by the Cleanup List logic
- **fixed** — Prevent path traversal in orphaned job APIs
- **fixed** — Disk Full errors from unrar were not handled gracefully during unpacking
- **fixed** — Memory leak could occur during article decoding
- **fixed** — In containers like Docker, the Article Cache could exceed the memory limit
- **fixed** — Diskspace checks would be too strict when unpacking to different disk
- **fixed** — Prevent deadlock when a second signal arrives during shutdown procedure
- **fixed** — Verification using SFV-checks could fail, even though files were correct
- **fixed** — Don't log Warning during clean shutdowns
- **fixed** — Windows: Uninstall would not remove Settings or Windows Service
- **fixed** — Windows: Warn for OS-limit if more than 1024 connections are configured
- **fixed** — macOS: AppleDouble files could result in failures in Moving stage
- **fixed** — macOS: Restarting the application resulted in Terminal window
- **changed** — macOS: Included par2cmdline-turbo will now use all available CPU-features

Release Notes - SABnzbd 5.1.1
=========================================================

##### Critical authentication vulnerability resolved in 5.1.1 (GHSA-xrfq-jhgh-wqch)

You are only affected if an untrusted party can reach the web interface.
By default, SABnzbd is only accessible from your own device and `External internet access`
is set to `No access`. If either of those is still at its default, or if you use a proxy
service for authentication, you are not affected.

If the SABnzbd login page is reachable from outside your network, an attacker could
obtain a valid session in version 5.1.0 and earlier, even when SABnzbd is protected with
a username and password. This means that all information in SABnzbd would be exposed.

If you rely on the SABnzbd username and password to keep out other users on your
network or the internet, it is recommended that you change the following
sensitive information after applying the update:

* SABnzbd username and password.
* SABnzbd API-key.
* Usenet server passwords.
* API-keys from indexers used within RSS-feeds.
* Authentication information for notification services.

If you cannot update right away, the only mitigations are to ensure the web interface is not
reachable by untrusted parties, or to lower `External internet access` to `Full API` or below.

More information: https://sabnzbd.org/auth-bypass

##### Other bug fixes in 5.1.1

* Styling cache issues could occur after updating.
* RSS items were removed too eagerly from RSS-history after download.
* The RSS-feed `Clear Downloaded` button did not do anything.

##### Changelog 5.1.0

This release brings a fundamental improvement to "Retry": instead of
re-downloading any files with missing data, only the articles that were actually
missing are fetched again. RSS got an overhaul under the hood, the interface is
refreshed, and we added quite a long list of long-requested features and bugfixes.

##### New features in 5.1.0

* Refreshed the interface.
* When Retrying a job, only the actually missing articles are tried again.
  This only works for jobs downloaded in 5.1.0 (or newer).
* RSS items are now stored in the database instead of on disk.
* New RSS `Age` rule to filter jobs based on their age.
* Downloaded RSS items are cleared from the RSS database after 3 days.
* Added support for filename and path pattern matching to the `Cleanup List`.
* `Unwanted extensions` will also be removed after unpacking.
* Allow job setting changes directly from `Extra queue columns`.
* Added support for unpacking `.tar` files during post-processing.
* Improved anonymization of the logs when using `Show Logging`.
* Added `SAB_FILES` environment variable to Post-processing scripts,
  listing all files that resulted from the job.
* New Servers will default to 16 connections instead of 8.
* Use media duration as part of `Ignore Samples` detection.
* Added option to (auto) sort the queue by Remaining Percentage.
* Improved support for screen readers.
* Parsing of header-encrypted RARs will use significantly fewer resources.
* Add Ayatana AppIndicator tray support on GNOME.
* Removed redundant `INSTALL.txt` file.
* Dropped support for Python 3.9.
* Windows and macOS: Updated Python to 3.14.6, Unrar to 7.23 and 7zip to 26.02.

##### Bug fixes in 5.1.0

* Prevent incorrect warnings about non-writeable directories.
* Files unrelated to job could get removed by the `Cleanup List` logic.
* Prevent path traversal in orphaned job APIs.
* `Disk Full` errors from unrar were not handled gracefully during unpacking.
* Memory leak could occur during article decoding.
* In containers (like Docker), the Article Cache could exceed the memory limit.
* Diskspace checks would be too strict when unpacking to different disk.
* Prevent deadlock when a second signal arrives during shutdown procedure.
* Verification using SFV-checks could fail, even though files were correct.
* Don't log Warning during clean shutdowns.
* Windows: Uninstall would not remove Settings or Windows Ser

_[Truncated at 4000 characters — full notes: https://github.com/sabnzbd/sabnzbd/releases/tag/5.1.1]_