CVE-2026-113613GHSA-6v57-v478-59v9
FlexGet before 3.20.7 Path Traversal (Zip Slip) via decompress plugin
FlexGet FlexGet
CVSS
9.2CriticalExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.77%Chance of exploitation activity in the next 30 days, higher than 55% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 3.20.7FlexGetCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
FlexGet before 3.20.7 contains a path traversal vulnerability in the decompress plugin that allows remote attackers to write arbitrary files by supplying malicious archive member paths. Attackers can deliver zip or rar archives with ../ sequences or absolute paths through a feed, writing Python files into the plugins directory for code execution.
Text from CVE List
Affected versions 1
- FlexGetaffected: all versions before 3.20.7CVE List
References 5
- github.com/Flexget/Flexget/commit/38fa748461e20befee942f5c79d8a098edea5c1fFixvia CVE List
- github.com/Flexget/Flexget/releases/tag/v3.20.7Fixvia CVE List
- github.com/Flexget/Flexget/security/advisories/GHSA-6v57-v478-59v9Advisoryvia CVE List
- vulncheck.com/advisories/flexget-before-3.20.7-path-traversal-zip-slip-via-decompress-pluginAdvisoryvia CVE List
- github.com/Flexget/Flexget/blob/v3.20.6/flexget/components/archives/decompress.py#L74-L77Referencevia CVE List