FlexGet: Path traversal (Zip Slip) in decompress plugin

Summary

FlexGet before 3.20.7 contains a path traversal (Zip Slip) flaw in its decompress plugin. A remote attacker can supply ZIP or RAR archives with ../ sequences or absolute paths through a feed, which writes files outside the intended directory. Written Python files in the plugins directory lead to code execution on the host running FlexGet, and no privileges are required.

Affected

• FlexGet versions before 3.20.7

Fixed in

• FlexGet 3.20.7

Workaround

• Unknown from vendor sources.
• Until the update is applied, disable the decompress plugin for untrusted feeds and run FlexGet as a low-privilege user with write access limited to its own download and data directories.

Exploitation

• No known exploitation in the wild.
• CISA SSVC: exploitation none, automatable no, technical impact total.

Our recommendation

• Update FlexGet to version 3.20.7 or later.
• Check all servers, NAS devices and containers for FlexGet and its installed version.
• Disable the decompress plugin for untrusted sources until the update is installed.
• Restrict FlexGet's write permissions and monitor the plugins directory for unexpected Python files.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-6v57-v478-59v9 github.com
• FlexGet release v3.20.7 github.com
• Patch commit 38fa748 github.com
• VulnCheck advisory www.vulncheck.com
• Vulnerable code at v3.20.6 github.com
• OpenCVE CVE-2026-113613 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:12.