CVE-2026-113613
Received Received - Intake

Path Traversal in FlexGet Decompress Plugin

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: VulnCheck

Description
FlexGet before 3.20.7 contains a path traversal vulnerability in the decompress plugin that allows remote attackers to write arbitrary files by supplying malicious archive member paths. Attackers can deliver zip or rar archives with ../ sequences or absolute paths through a feed, writing Python files into the plugins directory for code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-113613
EUVD
EUVD-2026-105091

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
FlexGet FlexGet 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-113613 is a path traversal vulnerability in FlexGet versions before 3.20.7. It exists in the decompress plugin, which processes archive files like zip or rar. Attackers can craft malicious archives with directory traversal sequences (../) or absolute paths to write files outside the intended extraction directory. This allows writing Python files into the plugins directory, potentially leading to arbitrary code execution.

Detection Guidance

To detect this vulnerability, check if your FlexGet version is prior to 3.20.7. Run: flexget --version. If the version is below 3.20.7, the system is vulnerable. Additionally, monitor logs for failed archive extractions or unexpected file writes in the plugins directory.

Impact Analysis

This vulnerability allows remote attackers to execute arbitrary code on your system by exploiting malicious archives. If you use FlexGet to process untrusted archives, attackers could overwrite critical files, install malware, or gain full control of your system. The impact includes data theft, system compromise, and potential lateral movement in networks.

Mitigation Strategies

Immediately upgrade FlexGet to version 3.20.7 or later. As a temporary measure, disable the decompress plugin in your FlexGet configuration file. Remove any untrusted feeds or archives that may have been processed by the vulnerable plugin.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113613. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart