Path Traversal Vulnerability in FlexGet by FlexGet
CVE-2026-113613

9.2CRITICAL

Key Information:

Vendor

Flexget

Status
Flexget
Vendor
CVE Published:
20 October 2026

What is CVE-2026-113613?

FlexGet before version 3.20.7 is susceptible to a path traversal vulnerability within its decompress plugin. This flaw can be exploited by remote attackers who provide malicious archive member paths, such as zip or rar files containing '../' sequences or absolute paths. Exploiting this vulnerability allows attackers to write arbitrary files, including executable Python scripts, into the plugins directory, potentially leading to unauthorized code execution. It is essential to update to version 3.20.7 or later to mitigate this risk.

Affected Version(s)

FlexGet 0 < 3.20.7

References

https://github.com/Flexget/Flexget/security/advisories/GH...
vendor-advisory
https://github.com/Flexget/Flexget/commit/38fa748461e20be...
patch
https://github.com/Flexget/Flexget/releases/tag/v3.20.7
release-notes

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Shmulik Cohen
.