Vulnerability · Published Aug 5, 2026 · Assigned by TuranSec

CVE-2026-71284Fledge IoT Gateway Backup Restore OS Command Injection via Tar Member Filename

High 7.2

In plain English

A high-severity OS command injection in fledge from fledge-iot. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)0.9%top 39.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Fledge's backup-restore upload handler, upload_backup (python/fledge/services/core/api/backup_restore.py), takes the first extracted tar member's filename (tar_file_names[0]) and builds a shell command via string formatting. Because os.system invokes a shell and no quoting (shlex.quote, list-form subprocess) is applied, an admin uploading a crafted backup archive achieves arbitrary OS command execution.

Affected products (as reported)

Vendor	Product	Versions
fledge-iot	fledge	0 – through 3.1.0

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/fledge-iot/fledge third-party-advisory
https://github.com/fledge-iot/fledge/blob/main/python/fledge/services/core/api/backup_restore.py third-party-advisory