CVE-2026-71284

{
  "id": "CVE-2026-71284",
  "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
  "published": "2026-08-05T13:24:53.093",
  "lastModified": "2026-10-23T21:10:00.157",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Fledge's backup-restore upload handler, upload_backup (python/fledge/services/core/api/backup_restore.py), takes the first extracted tar member's filename (tar_file_names[0]) and builds a shell command via string formatting. Because os.system invokes a shell and no quoting (shlex.quote, list-form subprocess) is applied, an admin uploading a crafted backup archive achieves arbitrary OS command execution."
    },
    {
      "lang": "es",
      "value": "El gestor de carga de copia de seguridad y restauración de Fledge, upload_backup() (python/fledge/services/core/api/backup_restore.py), toma el nombre de archivo del primer miembro tar extraído (tar_file_names[0]) y construye un comando de shell mediante formato de cadena: ’cmd = “cp {} {}”.format(source, backup_path); ret_code = os.system(cmd)’. La única verificación previa en el nombre de archivo es una coincidencia de prefijo/sufijo (startswith(backup_prefix), endswith(valid_extensions)), que un nombre como ’fledge_backup_$(id>/tmp/pwn).db’ satisface mientras sigue inyectando una sustitución de comando de shell. Debido a que os.system() invoca un shell y no se aplica ningún tipo de entrecomillado (shlex.quote, subprocess en formato de lista), un administrador que carga un archivo de copia de seguridad manipulado logra la ejecución arbitraria de comandos del sistema operativo."
    }
  ],
  "affected": [
    {
      "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
      "affectedData": [
        {
          "vendor": "fledge-iot",
          "product": "fledge",
          "defaultStatus": "unaffected",
          "programFiles": [
            "python/fledge/services/core/api/backup_restore.py"
          ],
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "3.1.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 7.2,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-05T15:52:35.521988Z",
          "id": "CVE-2026-71284",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/fledge-iot/fledge",
      "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"
    },
    {
      "url": "https://github.com/fledge-iot/fledge/blob/main/python/fledge/services/core/api/backup_restore.py",
      "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"
    }
  ]
}