CVE-2026-113613: FlexGet before 3.20.7 Path Traversal (Zip Slip) via decompress plugin
FlexGet before 3.20.7 contains a path traversal vulnerability in the decompress plugin that allows remote attackers to write arbitrary files by supplying malicious archive member paths. Attackers can deliver zip or rar archives with ../ sequences or absolute paths through a feed, writing Python files into the plugins directory for code execution.
Affected Software
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An attacker must be able to supply a ZIP or RAR archive through a feed processed by the decompress plugin. The archive must contain member paths using ../ sequences or absolute paths.
What systems are exposed?
FlexGet installations running a version before 3.20.7 are affected when they use the decompress plugin to process attacker-supplied archives from a feed. No authentication or user interaction is required according to the supplied vector.
What is the practical impact of a successful exploit?
A malicious archive can cause arbitrary file writes outside the intended extraction location. Writing Python files into the plugins directory can lead to code execution.
How can I determine whether an instance may be affected?
Check whether the FlexGet version is earlier than 3.20.7 and whether the decompress plugin processes ZIP or RAR files from feeds. Review processed archives and filesystem changes for unexpected files written outside the extraction directory, particularly Python files in the plugins directory.