CVE-2026-113613 in FlexGet
Summary
by MITRE • 10/20/2026
FlexGet before 3.20.7 contains a path traversal vulnerability in the decompress plugin that allows remote attackers to write arbitrary files by supplying malicious archive member paths. Attackers can deliver zip or rar archives with ../ sequences or absolute paths through a feed, writing Python files into the plugins directory for code execution.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
The FlexGet application, prior to version 3.20.7, contains a critical path traversal vulnerability within its decompress plugin that poses significant risks to system integrity and confidentiality. This flaw arises from insufficient validation of archive member paths during the extraction process. When users configure feeds to automatically download and extract compressed archives such as ZIP or RAR files, the software fails to sanitize file names contained within these archives. Specifically, attackers can craft malicious archives containing entries with directory traversal sequences like ../ or absolute path references. Upon processing these feeds, FlexGet attempts to write the extracted contents directly to disk without verifying that the resulting destination remains within the intended extraction directory. This lack of boundary enforcement allows an attacker to control the output location of files written by the application.
The operational impact of this vulnerability is severe, as it enables remote code execution under specific conditions. By manipulating archive member paths, a malicious actor can force FlexGet to write arbitrary files into sensitive directories on the host system. A particularly dangerous scenario involves writing Python script files directly into the plugins directory where FlexLoad loads modules from at runtime. If an attacker successfully places a crafted Python file in this location and triggers its loading through subsequent feed processing or application restarts, they achieve arbitrary code execution with the privileges of the user running the FlexGet process. This effectively compromises the entire system under that user context, allowing for data exfiltration, persistence mechanisms, lateral movement within internal networks, or complete system takeover depending on the environment configuration and privilege levels involved.
From a classification perspective, this vulnerability aligns closely with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which describes issues where software does not properly neutralize special elements such as ../ sequences in file paths. Additionally, the exploitation technique maps to MITRE ATT&CK techniques related to Command and Scripting Interpreter abuse, specifically T1059 if script execution is achieved via Python modules loaded by the application framework. The attack vector typically involves delivering malicious archives through trusted or semi-trusted feeds, leveraging the trust relationship between the user and the content sources managed by FlexGet. This makes detection difficult as the traffic appears to be legitimate feed updates rather than direct exploitation attempts against network services.
Mitigation strategies must focus on immediate patching and defensive configuration changes. The primary remediation is upgrading FlexGet to version 3.20.7 or later, where this path traversal issue has been addressed through improved input validation and canonicalization of file paths before extraction. Organizations relying on automated feed processing should implement strict allow-lists for trusted sources and consider running the application with minimal privileges to limit the blast radius in case of a successful exploit. Furthermore, administrators can enhance security by disabling automatic plugin loading from user-writable directories if such functionality is not strictly required, or by configuring file system permissions to prevent writing executable code into critical application directories. Regular auditing of feed sources and monitoring for unusual file creation events in application directories can also aid in early detection of attempted exploitation activities.