Vulnerability Description
FlexGet before 3.20.7 contains a path traversal vulnerability in the decompress plugin that allows remote attackers to write arbitrary files by supplying malicious archive member paths. Attackers can deliver zip or rar archives with ../ sequences or absolute paths through a feed, writing Python files into the plugins directory for code execution.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/Flexget/Flexget/blob/v3.20.6/flexget/components/archives/deco
- https://github.com/Flexget/Flexget/commit/38fa748461e20befee942f5c79d8a098edea5c
- https://github.com/Flexget/Flexget/releases/tag/v3.20.7
- https://github.com/Flexget/Flexget/security/advisories/GHSA-6v57-v478-59v9
- https://www.vulncheck.com/advisories/flexget-before-3.20.7-path-traversal-zip-sl
FAQ
What is CVE-2026-113613?
CVE-2026-113613 is a vulnerability with a CVSS score of 8.1 (HIGH). FlexGet before 3.20.7 contains a path traversal vulnerability in the decompress plugin that allows remote attackers to write arbitrary files by supplying malicious archive member paths. Attackers can ...
How severe is CVE-2026-113613?
CVE-2026-113613 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-113613?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.