CVE-2026-71283

MediumCVSS 4.9

Published: 05/08/2026(UTC)Updated: 26/08/2026(UTC)Translated: 10/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

21th percentile - higher than 21% of all known CVEs

Summary

Fledge's backup-restore upload handler calls tarfile.extractall(temp_path) on an admin-uploaded tar archive with no filter argument and no per-member path validation. Requires the admin role.

Risk Assessment

An attacker with admin role can exploit this to extract a malicious archive, potentially writing files to unexpected locations and compromising the system.

Recommendation

Apply vendor patches for Fledge. Restrict access to administrative functions and validate archives before extraction.

Other vulnerabilities in Fledge

CVE-2026-71284High
Fledge's backup-restore upload handler, upload_backup (python/fledge/services/core/api/backup_restore.py), takes the first extracted tar member's filename (tar_file_names[0]) and builds a shell command via string formatting. Because os.system invokes a shell and no quoting (shlex.quote, list-form subprocess) is applied, an admin uploading a crafted backup archive achieves arbitrary OS command execution.

Original NVD description (English source)

Fledge's backup-restore upload handler, upload_backup (python/fledge/services/core/api/backup_restore.py), calls tarfile.extractall(temp_path) on an admin-uploaded tar archive with no filter argument and no per-member path validation. Requires the admin role (@has_permission("admin")).