CRITICAL 9.2 NVD
CVE-2026-113613
FlexGet before 3.20.7 contains a path traversal vulnerability in the decompress plugin that allows remote attackers to write arbitrary files by supplying malici
FlexGet before 3.20.7 contains a path traversal vulnerability in the decompress plugin that allows remote attackers to write arbitrary files by supplying malicious archive member paths. Attackers can deliver zip or rar archives with ../ sequences or absolute paths through a feed, writing Python files into the plugins directory for code execution.
References
- https://github.com/Flexget/Flexget/blob/v3.20.6/flexget/components/archives/decompress.py#
- https://github.com/Flexget/Flexget/commit/38fa748461e20befee942f5c79d8a098edea5c1f
- https://github.com/Flexget/Flexget/releases/tag/v3.20.7
- https://github.com/Flexget/Flexget/security/advisories/GHSA-6v57-v478-59v9
- https://www.vulncheck.com/advisories/flexget-before-3.20.7-path-traversal-zip-slip-via-dec
This critical severity vulnerability with a CVSS score of 9.2 was published on 2026-10-20 via NVD.
Risk Timeline
CVE Disclosed2026-10-20 · -1 days ago
Remediation Resources
vulnfeed aggregates 16920 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.