CVE-2026-71284

Name of the Vulnerable Software and Affected Versions Fledge (affected versions not specified)

Description The backup-restore upload handler upload backup() located in python/fledge/services/core/api/backup restore.py is susceptible to OS command injection. The handler processes the first extracted tar member's filename tar file names[0] and incorporates it into a shell command using string formatting. Because the system uses os.system() without proper quoting or the use of list-form subprocesses, an administrator can upload a specially crafted backup archive to execute arbitrary operating system commands. The existing validation only checks for specific prefixes and suffixes, which can be bypassed using shell command substitution in the filename.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.