FlexGet vulnerabilities

CVEs whose affected-version data names the FlexGet package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-113613High· 8.1

today

FlexGet before 3.20.7 Path Traversal (Zip Slip) via decompress plugin

FlexGet before 3.20.7 contains a path traversal vulnerability in the decompress plugin that allows remote attackers to write arbitrary files by supplying malicious archive member paths. Attackers can deliver zip or rar archives with ../ …

▾ TwilightFlexGet · FlexGetvia CVEORG