Description
FlexGet before 3.20.7 contains a path traversal vulnerability in the decompress plugin that allows remote attackers to write arbitrary files by supplying malicious archive member paths. Attackers can deliver zip or rar archives with ../ sequences or absolute paths through a feed, writing Python files into the plugins directory for code execution.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| FlexGet | FlexGet | < 3.20.7 | 3.20.7 |
References
- GitHub Security Advisory (GHSA-6v57-v478-59v9) vendor-advisory
- https://github.com/Flexget/Flexget/commit/38fa748461e20befee942f5c79d8a098edea5c1f patch
- FlexGet v3.20.7 Release Notes release-notes
- https://github.com/Flexget/Flexget/blob/v3.20.6/flexget/components/archives/decompress.py#L74-L77 technical-description
- VulnCheck Advisory: FlexGet before 3.20.7 Path Traversal (Zip Slip) via decompress plugin third-party-advisory