Vulnerability · Published Oct 20, 2026 · Assigned by VulnCheck
CVE-2026-113613FlexGet before 3.20.7 Path Traversal (Zip Slip) via decompress plugin
High 8.1
In plain English
A high-severity path traversal in FlexGet from FlexGet. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities).
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.9%top 39.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
FlexGet before 3.20.7 contains a path traversal vulnerability in the decompress plugin that allows remote attackers to write arbitrary files by supplying malicious archive member paths. Attackers can deliver zip or rar archives with ../ sequences or absolute paths through a feed, writing Python files into the plugins directory for code execution.
Affected products (as reported)
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- GitHub Security Advisory (GHSA-6v57-v478-59v9) vendor-advisory
- https://github.com/Flexget/Flexget/commit/38fa748461e20befee942f5c79d8a098edea5c1f patch
- FlexGet v3.20.7 Release Notes release-notes
- https://github.com/Flexget/Flexget/blob/v3.20.6/flexget/components/archives/decompress.py#L74-L77 technical-description
- VulnCheck Advisory: FlexGet before 3.20.7 Path Traversal (Zip Slip) via decompress plugin third-party-advisory