Flexget
Monthly
Path traversal (Zip Slip) in FlexGet's optional decompress plugin allows remote attackers to write arbitrary files outside the intended extraction directory by delivering archives containing ../ sequences or absolute member paths through a feed. Affected are FlexGet releases before 3.20.7 that have the decompress plugin configured; an attacker who can supply or poison a feed consumed by the target can drop Python files into FlexGet's plugins directory, achieving code execution with the privileges of the FlexGet process. A vendor fix exists in 3.20.7 (commit 38fa748) adding a resolved-path containment check and a PathTraversalError class, and the public commit diff plus regression tests effectively document the exploitation technique; no public exploit was identified at time of analysis and there is no KEV confirmation of active exploitation.
Path traversal (Zip Slip) in FlexGet's optional decompress plugin allows remote attackers to write arbitrary files outside the intended extraction directory by delivering archives containing ../ sequences or absolute member paths through a feed. Affected are FlexGet releases before 3.20.7 that have the decompress plugin configured; an attacker who can supply or poison a feed consumed by the target can drop Python files into FlexGet's plugins directory, achieving code execution with the privileges of the FlexGet process. A vendor fix exists in 3.20.7 (commit 38fa748) adding a resolved-path containment check and a PathTraversalError class, and the public commit diff plus regression tests effectively document the exploitation technique; no public exploit was identified at time of analysis and there is no KEV confirmation of active exploitation.