CVE-2026-71283

Fledge's backup-restore upload handler, upload_backup (python/fledge/services/core/api/backup_restore.py), calls tarfile.extractall(temp_path) on an admin-uploaded tar archive with no filter argument and no per-member path validation. Requires the admin role (@has_permission("admin")).

CVSS v3 4.9 MEDIUM

4.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/fledge-iot/fledge
https://github.com/fledge-iot/fledge/blob/main/python/fledge/services/core/api/backup_restore.py

Configurations

No configuration.

History

23 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) El gestor de carga de copia de seguridad y restauración de Fledge, upload_backup() (python/fledge/services/core/api/backup_restore.py), llama a tarfile.extractall(temp_path) en un archivo tar subido por un administrador sin argumento de filtro y sin validación de ruta por miembro. Un archivo tar manipulado que contiene nombres de miembros con componentes de ruta ’.. / ’ extrae archivos fuera del directorio temporal previsto, permitiendo escrituras de archivos arbitrarias en cualquier lugar del sistema de archivos accesible por el proceso de Fledge. Requiere el rol de administrador (@has_permission(’admin’)).

Information

Published : 2026-08-05 13:24

Updated : 2026-10-23 21:10

NVD link : CVE-2026-71283

Mitre link : CVE-2026-71283

CVE.ORG link : CVE-2026-71283

JSON object : View

Products Affected

No product.

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-71283", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71283", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-05T15:52:56.335077Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.2}]}, "affected": [{"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "affectedData": [{"vendor": "fledge-iot", "product": "fledge", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.1.0"}], "programFiles": ["python/fledge/services/core/api/backup_restore.py"], "defaultStatus": "unaffected"}]}], "published": "2026-08-05T13:24:52.970", "references": [{"url": "https://github.com/fledge-iot/fledge", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}, {"url": "https://github.com/fledge-iot/fledge/blob/main/python/fledge/services/core/api/backup_restore.py", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Fledge's backup-restore upload handler, upload_backup (python/fledge/services/core/api/backup_restore.py), calls tarfile.extractall(temp_path) on an admin-uploaded tar archive with no filter argument and no per-member path validation. Requires the admin role (@has_permission(\"admin\"))."}, {"lang": "es", "value": "El gestor de carga de copia de seguridad y restauraci\u00f3n de Fledge, upload_backup() (python/fledge/services/core/api/backup_restore.py), llama a tarfile.extractall(temp_path) en un archivo tar subido por un administrador sin argumento de filtro y sin validaci\u00f3n de ruta por miembro. Un archivo tar manipulado que contiene nombres de miembros con componentes de ruta \u2019.. / \u2019 extrae archivos fuera del directorio temporal previsto, permitiendo escrituras de archivos arbitrarias en cualquier lugar del sistema de archivos accesible por el proceso de Fledge. Requiere el rol de administrador (@has_permission(\u2019admin\u2019))."}], "lastModified": "2026-10-23T21:10:00.157", "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}