CVE-2026-71283
Received Received - Intake

Fledge Backup-Restore Path Traversal Vulnerability

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
Fledge's backup-restore upload handler, upload_backup() (python/fledge/services/core/api/backup_restore.py), calls tarfile.extractall(temp_path) on an admin-uploaded tar archive with no filter argument and no per-member path validation. A crafted tar archive containing member names with `../` path components extracts files outside the intended temporary directory, allowing arbitrary file writes anywhere on the filesystem reachable by the Fledge process. Requires the admin role (@has_permission("admin")).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-71283
EUVD
EUVD-2026-53368

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
fledge backup_restore *
fledge iot_platform *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in Fledge's backup-restore upload handler. The function upload_backup() extracts a tar archive without validating member paths or using a filter. A crafted tar file with ../ in member names can write files outside the intended temporary directory, allowing arbitrary file writes anywhere on the filesystem accessible by the Fledge process. It requires admin privileges.

Detection Guidance

Monitor for unexpected file writes outside intended directories, especially by the Fledge process. Check logs for admin-uploaded tar archives with suspicious path components like '../'. Inspect filesystem for unauthorized modifications in paths accessible to Fledge.

Impact Analysis

An attacker with admin access could exploit this to overwrite critical system files, leading to denial of service, data corruption, or unauthorized code execution. This could disrupt Fledge operations or allow further attacks on the host system.

Compliance Impact

This vulnerability could lead to unauthorized file writes anywhere on the filesystem, potentially exposing or modifying sensitive data. For GDPR, this may violate principles of data integrity and confidentiality. For HIPAA, it could result in unauthorized access to protected health information, leading to compliance violations.

Mitigation Strategies

Apply patches or updates from Fledge addressing the tarfile.extractall() issue. Restrict admin uploads to trusted sources only. Implement strict path validation for tar archive members. Review filesystem permissions for the Fledge process to limit write access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71283. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart