The CVE-2026-71284 vulnerability affects Fledge's backup-restore feature, specifically the upload_backup() function in python/fledge/services/core/api/backup_restore.py. This function is vulnerable to shell command injection due to improper handling of filenames. An attacker can inject malicious commands by crafting a backup archive with a filename that satisfies the prefix/suffix match but contains shell [truncated]
Fledge's backup-restore feature is vulnerable to arbitrary file writes due to insecure tar archive extraction. An admin user can upload a crafted tar archive, allowing files to be extracted outside the intended temporary directory. This requires the admin role and allows for potential writes anywhere on the filesystem reachable by the Fledge process. Evidence suggests that defenders verify access controls [truncated]
