{"id":"CVE-2026-113613","published":"2026-10-20T16:17:11.933","lastModified":"2026-10-21T16:17:23.833","description":"FlexGet before 3.20.7 contains a path traversal vulnerability in the decompress plugin that allows remote attackers to write arbitrary files by supplying malicious archive member paths. Attackers can deliver zip or rar archives with ../ sequences or absolute paths through a feed, writing Python files into the plugins directory for code execution.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-22"],"vendors":[],"products":[],"references":[{"url":"https://github.com/Flexget/Flexget/blob/v3.20.6/flexget/components/archives/decompress.py#L74-L77","tags":[]},{"url":"https://github.com/Flexget/Flexget/commit/38fa748461e20befee942f5c79d8a098edea5c1f","tags":[]},{"url":"https://github.com/Flexget/Flexget/releases/tag/v3.20.7","tags":[]},{"url":"https://github.com/Flexget/Flexget/security/advisories/GHSA-6v57-v478-59v9","tags":[]},{"url":"https://www.vulncheck.com/advisories/flexget-before-3.20.7-path-traversal-zip-slip-via-decompress-plugin","tags":[]}],"exploitRefs":[{"url":"https://github.com/Flexget/Flexget/blob/v3.20.6/flexget/components/archives/decompress.py#L74-L77","tags":[]},{"url":"https://github.com/Flexget/Flexget/commit/38fa748461e20befee942f5c79d8a098edea5c1f","tags":[]},{"url":"https://github.com/Flexget/Flexget/releases/tag/v3.20.7","tags":[]},{"url":"https://github.com/Flexget/Flexget/security/advisories/GHSA-6v57-v478-59v9","tags":[]}],"hasPoc":true,"ai":null}