CVE-2026-71284

7.2 HIGHpublic exploit available

Published 2026-08-05 · Updated 2026-08-10

AI risk analysis

Summary: The flaw allows an admin to execute arbitrary OS commands by crafting a backup archive, leading to Remote Code Execution (RCE).
Exploitability: Exploitation requires administrative access and a crafted backup archive; moderate effort needed.
Blast radius: If exploited, the impact could be severe, potentially compromising the entire system.
Prioritized remediation: Update Fledge to a version that properly handles file uploads and command execution.

rceos-command-injectionbackup

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Fledge's backup-restore upload handler, upload_backup (python/fledge/services/core/api/backup_restore.py), takes the first extracted tar member's filename (tar_file_names[0]) and builds a shell command via string formatting. Because os.system invokes a shell and no quoting (shlex.quote, list-form subprocess) is applied, an admin uploading a crafted backup archive achieves arbitrary OS command execution.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-78

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.