CVE-2026-113613

8.1High

Published 20 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash

8.1High

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-22

Impact

Remote attackers can execute arbitrary code by overwriting files or dropping Python files into the plugins directory. To exploit it, an attacker needs to serve malicious zip or rar archives through an ingested feed processed by FlexGet.

Root cause

The decompress plugin does not sanitize archive member filenames, allowing path traversal via '../' sequences or absolute paths during extraction.

Affected systems

FlexGet before 3.20.7

CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade FlexGet to version 3.20.7 or later. As an interim workaround, disable the decompress plugin in your FlexGet task configurations.

shell

$ pip install --upgrade 'flexget>=3.20.7'

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

FlexGet before 3.20.7 contains a path traversal vulnerability in the decompress plugin that allows remote attackers to write arbitrary files by supplying malicious archive member paths. Attackers can deliver zip or rar archives with ../ sequences or absolute paths through a feed, writing Python files into the plugins directory for code execution.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-113613