Live › vulnerability › CVE-2026-113613
Go to dashboardFlexGet's decompress plugin trusts archive member paths, so a crafted zip or rar with ../ or absolute paths can write arbitrary files. An attacker can drop a Python file into the plugins directory and get code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
pip show flexget and check whether the version is below 3.20.7Upgrade FlexGet to 3.20.7 or later with pip install --upgrade flexget.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
FlexGet before 3.20.7 contains a path traversal vulnerability in the decompress plugin that allows remote attackers to write arbitrary files by supplying malicious archive member paths. Attackers can deliver zip or rar archives with ../ sequences or absolute paths through a feed, writing Python files into the plugins directory for code execution.
This page as .md · .json · in your agent: get_signal("CVE-2026-113613")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.