{"id":"CVE-2026-113613","title":"FlexGet before 3.20.7 Path Traversal (Zip Slip) via decompress plugin","summary":"FlexGet before 3.20.7 contains a path traversal vulnerability in the decompress plugin that allows remote attackers to write arbitrary files by supplying malicious archive member paths. Attackers can deliver zip or rar archives with ../ …","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-22"],"vendor":"FlexGet","product":"FlexGet","affected":["FlexGet < 3.20.7"],"published":"2026-10-20","updated":"2026-10-20","sourceUpdated":"2026-10-20T15:40:37.585Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-113613","references":[{"url":"https://github.com/Flexget/Flexget/security/advisories/GHSA-6v57-v478-59v9","label":"GitHub Security Advisory (GHSA-6v57-v478-59v9)"},{"url":"https://github.com/Flexget/Flexget/commit/38fa748461e20befee942f5c79d8a098edea5c1f"},{"url":"https://github.com/Flexget/Flexget/releases/tag/v3.20.7","label":"FlexGet v3.20.7 Release Notes"},{"url":"https://github.com/Flexget/Flexget/blob/v3.20.6/flexget/components/archives/decompress.py#L74-L77"},{"url":"https://www.vulncheck.com/advisories/flexget-before-3.20.7-path-traversal-zip-slip-via-decompress-plugin","label":"VulnCheck Advisory: FlexGet before 3.20.7 Path Traversal (Zip Slip) via decompress plugin"}],"tags":["cve.org"],"ingestedAt":"2026-10-20T16:10:53.300Z","slug":"CVE-2026-113613","body":"## Overview\n\nFlexGet before 3.20.7 contains a path traversal vulnerability in the decompress plugin that allows remote attackers to write arbitrary files by supplying malicious archive member paths. Attackers can deliver zip or rar archives with ../ sequences or absolute paths through a feed, writing Python files into the plugins directory for code execution.\n\n## Affected\n\n- `FlexGet < 3.20.7`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}