External risk intelligence

FlexGet Path Traversal Vulnerability Allows Arbitrary File Writes.

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-113613

FlexGet is a tool typically used for automating media downloads and file management. While it often operates as a background service or cron job processing internal or RSS feeds, it can be configured with web interfaces or exposed APIs. Public internet exposure is possible depending on user configuration, but it is not inherently designed as a public-facing edge gateway or identity service.

Path Traversal

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a path traversal vulnerability in the FlexGet decompress plugin, a software used for automating media downloads and file management. The vulnerability could allow remote attackers to write arbitrary files to the system by submitting specially crafted archive files. The main concern at this time is confirming the relevance and exposure of this technology within your environment.

Attackers can write files to systems.
It affects file management automation tools.
Confirm if this software is in use.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted archive file through a feed. If the application processes this archive using the decompress plugin, the attacker's malicious archive member paths could trick the system into writing files to arbitrary locations on the server, potentially enabling code execution.

Exposed feed processing required.
Malicious archive member paths.
Arbitrary file write leading to code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow remote attackers to write arbitrary files to the system by crafting malicious archive files. When processed by the decompress plugin, specially designed archive members containing path traversal sequences or absolute paths could lead to the overwriting or placement of files within the FlexGet installation directory, potentially enabling code execution.

Arbitrary file write to system.
Malicious archives processed by plugin.
Remote code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

The FlexGet application owner is primarily responsible for addressing this vulnerability, as it affects a specific plugin within the application. The initial step involves identifying all FlexGet instances, confirming their reachability and criticality, and then coordinating remediation with the application owner and potentially the platform team.

Application owner must address.
Verify external reachability and criticality.
Plan and execute remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is FlexGet?

FlexGet is a versatile automation tool used primarily to manage file downloads and organize media content. It functions as a background service or automated process that monitors various sources, such as RSS feeds, to trigger tasks like file decompression and sorting.

What does path traversal mean for CVE-2026-113613?

This vulnerability, classified as CWE-22, occurs when the software fails to properly sanitize input. In this case, the decompress plugin processes malicious archive files containing directory traversal sequences like "../" or absolute paths. This flaw allows an attacker to escape intended storage directories and write files to arbitrary locations, such as the plugins folder, which can result in unauthorized code execution.

How does an attacker trigger this vulnerability?

An attacker triggers the flaw by delivering a specially crafted zip or rar archive through a feed that the application processes. It is important to note that the vulnerability is specific to the decompress plugin's handling of archive member paths; simply having the software installed is not enough. The system must actively fetch and decompress a malicious archive for the attack to occur.

Is my instance of FlexGet at risk?

According to Halo Surface Signal, risk depends on how you have configured the software. While FlexGet is often used for internal automation, it may be exposed if you have enabled web interfaces or public-facing APIs. You should assess whether your specific instance is reachable from the internet or if it processes untrusted feeds, as these configurations increase the likelihood of exploitation.

What should I do if I am running FlexGet?

Your first step is to identify all instances of FlexGet running within your environment and determine their version. Since this vulnerability is addressed in version 3.20.7, you should coordinate with your application owners to update to this version or newer. Verify the reachability of your instances and prioritize patching those that process external or untrusted data feeds.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.