CVE-2026-71284
Received Received - Intake

Command Injection in Fledge Backup-Restore Handler

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
Fledge's backup-restore upload handler, upload_backup() (python/fledge/services/core/api/backup_restore.py), takes the first extracted tar member's filename (tar_file_names[0]) and builds a shell command via string formatting: `cmd = "cp {} {}".format(source, backup_path); ret_code = os.system(cmd)`. The only pre-check on the filename is a prefix/suffix match (startswith(backup_prefix), endswith(valid_extensions)), which a name such as `fledge_backup_$(id>/tmp/pwn).db` satisfies while still injecting a shell command substitution. Because os.system() invokes a shell and no quoting (shlex.quote, list-form subprocess) is applied, an admin uploading a crafted backup archive achieves arbitrary OS command execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-71284
EUVD
EUVD-2026-53369

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
fledge iot *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves an improperly sanitized filename in Fledge's backup-restore upload handler. The function upload_backup() extracts a tar archive and uses the first filename in the archive to construct a shell command without proper escaping. A crafted filename like 'fledge_backup_$(id>/tmp/pwn).db' can inject shell commands, leading to arbitrary OS command execution when the admin uploads the backup.

Detection Guidance

Check for unusual backup filenames containing shell metacharacters or command substitutions like $(command) or ;command in backup archives. Monitor system logs for unexpected os.system() calls or shell commands executed by the Fledge backup-restore service.

Impact Analysis

An attacker could exploit this to execute arbitrary commands on the system where Fledge is running. This could allow unauthorized access, data theft, or system compromise, especially since the vulnerability is triggered by an admin uploading a malicious backup file.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's integrity and confidentiality requirements or HIPAA's security rules. Non-compliance risks include fines, legal penalties, and reputational damage due to compromised sensitive data.

Mitigation Strategies

Disable the backup-restore upload handler in Fledge until patched. Restrict access to the upload endpoint to trusted administrators only. Review and sanitize all backup filenames before processing. Consider using subprocess.run() with proper argument lists instead of os.system().

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71284. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart