CVE-2026-113613— FlexGet before 3.20.7 Path Traversal (Zip Slip) via decompress plugin
Quick assessment
Affected
FlexGet FlexGet
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
FlexGet 在 3.20.7 之前的版本中，其解压插件存在路径遍历漏洞。远程攻击者可通过提供恶意的归档成员路径，写入任意文件。攻击者可以利用包含 "../" 序列或绝对路径的 ZIP 或 RAR 归档文件，通过订阅源（feed）将 Python 文件写入插件目录，从而实现代码执行。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1203 · Exploitation for Client Execution
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-113613
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
FlexGet before 3.20.7 Path Traversal (Zip Slip) via decompress plugin
Source: CVE Program / CVE List V5
Vulnerability Description
FlexGet before 3.20.7 contains a path traversal vulnerability in the decompress plugin that allows remote attackers to write arbitrary files by supplying malicious archive member paths. Attackers can deliver zip or rar archives with ../ sequences or absolute paths through a feed, writing Python files into the plugins directory for code execution.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-113613
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-113613
请登录查看更多情报信息。
Other References for CVE-2026-113613 (5)
-
https://github.com/Flexget/Flexget/releases/tag/v3.20.7 release-notes
IV. Related Vulnerabilities
Same weakness: CWE-22
-
CVE-2026-113672
Argo CD: A Jsonnet import can read files from the repo-serve -
CVE-2026-105772
Arbitrary file read and write in Google ADK TypeScript (@goo -
CVE-2026-113664
ApostropheCMS import-export tar guard misses './..' because -
CVE-2026-113651
ApostropheCMS: Path traversal in uploadfs -
CVE-2026-113505
aaPanel Download Endpoint v2.py send_file path traversal
V. Comments for CVE-2026-113613
No comments yet