CVE-2026-71283 — Fledge IoT Gateway Backup Restore Tar Path Traversal
Fledge's backup-restore upload handler, upload_backup (python/fledge/services/core/api/backup_restore.py), calls tarfile.extractall(temp_path) on an admin-uploaded tar archive w…
Published: 2026-08-05 · CVSS: 4.9 · CVSS 3.1
Fledge's backup-restore upload handler, upload_backup (python/fledge/services/core/api/backup_restore.py), calls tarfile.extractall(temp_path) on an admin-uploaded tar archive with no filter argument and no per-member path validation. Requires the admin role (@has_permission("admin")).
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7