CVE-2026-113613

FlexGet before 3.20.7 contains a path traversal vulnerability in the decompress plugin that allows remote attackers to write arbitrary files by supplying malicious archive member paths. Attackers can deliver zip or rar archives with ../ sequences or absolute paths through a feed, writing Python...

CVE-2026-113613

FlexGet versions before 3.20.7 are vulnerable to a path traversal (Zip Slip) vulnerability within the decompress plugin . A remote attacker can exploit this by providing malicious zip or rar archives containing ../ sequences or absolute paths through a feed. This allows the attacker to write arbi...

EUVD-2026-105091

FlexGet before 3.20.7 contains a path traversal vulnerability in the decompress plugin that allows remote attackers to write arbitrary files by supplying malicious archive member paths. Attackers can deliver zip or rar archives with ../ sequences or absolute paths through a feed, writing Python...