CVE-2026-71284
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
Fledge's backup-restore upload handler, upload_backup (python/fledge/services/core/api/backup_restore.py), takes the first extracted tar member's filename (tar_file_names[0]) and builds a shell command via string formatting. Because os.system invokes a shell and no quoting (shlex.quote, list-form subprocess) is applied, an admin uploading a crafted backup archive achieves arbitrary OS command execution.
Risk Assessment
Risk of arbitrary OS command execution by an administrator, which could lead to full system compromise.
Recommendation
Apply a patch or update Fledge to use safe command invocation with proper quoting.
Other vulnerabilities in Fledge
Original NVD description (English source)
Fledge's backup-restore upload handler, upload_backup (python/fledge/services/core/api/backup_restore.py), takes the first extracted tar member's filename (tar_file_names[0]) and builds a shell command via string formatting. Because os.system invokes a shell and no quoting (shlex.quote, list-form subprocess) is applied, an admin uploading a crafted backup archive achieves arbitrary OS command execution.