CVE-2026-71283

Name of the Vulnerable Software and Affected Versions Fledge (affected versions not specified)

Description The backup-restore upload handler upload backup() (python/fledge/services/core/api/backup restore.py) fails to validate per-member paths or use a filter argument when calling tarfile.extractall(temp path) on archives uploaded by an administrator. A crafted tar archive containing member names with ../ path components can lead to files being extracted outside the intended temporary directory, enabling arbitrary file writes anywhere on the filesystem accessible by the Fledge process. This issue requires the admin role (@has permission("admin")).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.