CVE-2026-71284
- Source
- https://cve.org/CVERecord?id=CVE-2026-71284
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71284.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-71284
- Published
- 2026-08-05T12:26:30.030Z
- Modified
- 2026-08-07T03:47:00.280933277Z
- Severity
-
- 7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- Fledge IoT Gateway Backup Restore OS Command Injection via Tar Member Filename
- Details
-
Fledge's backup-restore upload handler, uploadbackup() (python/fledge/services/core/api/backuprestore.py), takes the first extracted tar member's filename (tarfilenames[0]) and builds a shell command via string formatting:
cmd = "cp {} {}".format(source, backup_path); ret_code = os.system(cmd). The only pre-check on the filename is a prefix/suffix match (startswith(backupprefix), endswith(validextensions)), which a name such asfledge_backup_$(id>/tmp/pwn).dbsatisfies while still injecting a shell command substitution. Because os.system() invokes a shell and no quoting (shlex.quote, list-form subprocess) is applied, an admin uploading a crafted backup archive achieves arbitrary OS command execution. - Database specific
{ "cna_assigner": "TuranSec", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71284.json", "cwe_ids": [ "CWE-78" ] }- References