FlexGet before 3.20.7 contains a path traversal flaw (CWE-22) in its decompression plugin. By supplying a malicious zip or rar archive with crafted member paths that include "../" sequences or absolute paths, an attacker can cause the plugin to write arbitrary files onto the filesystem. Because the archive can contain Python scripts, the attacker may place custom code in the plugins directory, enabling execution of arbitrary code in the context of the FlexGet process.

The vulnerability affects the FlexGet automation tool, specifically versions prior to 3.20.7. The affected product is solely the FlexGet application. The vendor and product are "FlexGet:FlexGet". No additional version details are disclosed beyond the fact that releases earlier than 3.20.7 are impacted.

The CVSS base score of 9.2 classifies this flaw as Critical, indicating a high likelihood of successful exploitation and severe impact. The EPSS score is not currently available, and the vulnerability is not yet listed in the CISA KEV catalog. Attackers need only create a malicious archive and provide it to FlexGet via a feed, which is a remote attack vector. If successful, the exploit permits the attacker to persist arbitrary code through the plugins directory, allowing them to execute code with the privileges of the FlexGet process.