CVE-2026-71283 fledge-iot CVE debrief

Who should care

Administrators and users of Fledge's backup-restore feature should be aware of this vulnerability and take steps to mitigate it. Restricting access to the feature and monitoring for unusual file modifications can help prevent exploitation. Fledge's security team and vulnerability management processes should prioritize addressing this issue. Operators and platform administrators should review access controls and system monitoring to prevent potential exploitation.

Technical summary

Fledge's backup-restore upload handler, upload_backup() in python/fledge/services/core/api/backup_restore.py, uses tarfile.extractall() on an admin-uploaded tar archive without filtering or path validation. A crafted tar archive can extract files outside the intended temporary directory, allowing arbitrary file writes anywhere on the filesystem reachable by the Fledge process. This requires the admin role. The vulnerability allows an admin user to upload a tar archive that can write files outside the intended temporary directory.

Defensive priority

Fledge's backup-restore feature allows admin users to upload tar archives. A crafted tar archive can extract files outside the intended temporary directory, allowing arbitrary file writes. Monitor for unusual file modifications and restrict backup-restore access.

Recommended defensive actions

• Restrict access to the backup-restore feature to only necessary users
• Monitor for unusual file modifications on the Fledge system
• Implement additional validation and filtering on uploaded tar archives
• Consider using a more secure archive extraction method
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE description indicates that Fledge's backup-restore upload handler calls tarfile.extractall() on an admin-uploaded tar archive without filtering or path validation. This allows crafted tar archives to extract files outside the temporary directory, enabling arbitrary file writes. The vulnerability requires the admin role. Evidence limits suggest that defenders verify Fledge's backup-restore feature access controls and monitor for unusual file modifications.

Official resources