CVE-2026-71284

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-71284", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "state": "PUBLISHED", "assignerShortName": "TuranSec", "dateReserved": "2026-08-05T12:23:34.968Z", "datePublished": "2026-08-05T12:26:30.030Z", "dateUpdated": "2026-08-10T11:47:10.756Z"}, "containers": {"cna": {"title": "Fledge IoT Gateway Backup Restore OS Command Injection via Tar Member Filename", "descriptions": [{"lang": "en", "value": "Fledge's backup-restore upload handler, upload_backup (python/fledge/services/core/api/backup_restore.py), takes the first extracted tar member's filename (tar_file_names[0]) and builds a shell command via string formatting. Because os.system invokes a shell and no quoting (shlex.quote, list-form subprocess) is applied, an admin uploading a crafted backup archive achieves arbitrary OS command execution.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Fledge's backup-restore upload handler, upload_backup (python/fledge/services/core/api/backup_restore.py), takes the first extracted tar member's filename (tar_file_names[0]) and builds a shell command via string formatting. Because os.system invokes a shell and no quoting (shlex.quote, list-form subprocess) is applied, an admin uploading a crafted backup archive achieves arbitrary OS command execution.</p>"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-78", "cweId": "CWE-78", "type": "CWE"}]}], "affected": [{"vendor": "fledge-iot", "product": "fledge", "programFiles": ["python/fledge/services/core/api/backup_restore.py"], "versions": [{"version": "0", "lessThanOrEqual": "3.1.0", "status": "affected", "versionType": "semver"}], "defaultStatus": "unaffected"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}}], "references": [{"url": "https://github.com/fledge-iot/fledge", "tags": ["third-party-advisory"]}, {"url": "https://github.com/fledge-iot/fledge/blob/main/python/fledge/services/core/api/backup_restore.py", "tags": ["third-party-advisory"]}], "credits": [{"lang": "en", "value": "Alibek Baxtiyorov", "type": "finder"}], "providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-10T11:47:10.756Z"}, "source": {"discovery": "EXTERNAL"}, "datePublic": "2026-08-05T12:26:30.030Z"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-05T15:52:35.521988Z", "id": "CVE-2026-71284", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-05T15:52:42.370Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-71284", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-05T15:52:35.521988Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-05T15:52:38.812Z"}}], "cna": {"title": "Fledge IoT Gateway Backup Restore OS Command Injection via Tar Member Filename", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Alibek Baxtiyorov"}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "fledge-iot", "product": "fledge", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.1.0"}], "programFiles": ["python/fledge/services/core/api/backup_restore.py"], "defaultStatus": "unaffected"}], "datePublic": "2026-08-05T12:26:30.030Z", "references": [{"url": "https://github.com/fledge-iot/fledge", "tags": ["third-party-advisory"]}, {"url": "https://github.com/fledge-iot/fledge/blob/main/python/fledge/services/core/api/backup_restore.py", "tags": ["third-party-advisory"]}], "descriptions": [{"lang": "en", "value": "Fledge's backup-restore upload handler, upload_backup (python/fledge/services/core/api/backup_restore.py), takes the first extracted tar member's filename (tar_file_names[0]) and builds a shell command via string formatting. Because os.system invokes a shell and no quoting (shlex.quote, list-form subprocess) is applied, an admin uploading a crafted backup archive achieves arbitrary OS command execution.", "supportingMedia": [{"type": "text/html", "value": "<p>Fledge's backup-restore upload handler, upload_backup (python/fledge/services/core/api/backup_restore.py), takes the first extracted tar member's filename (tar_file_names[0]) and builds a shell command via string formatting. Because os.system invokes a shell and no quoting (shlex.quote, list-form subprocess) is applied, an admin uploading a crafted backup archive achieves arbitrary OS command execution.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78"}]}], "providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-10T11:47:10.756Z"}}}, "cveMetadata": {"cveId": "CVE-2026-71284", "state": "PUBLISHED", "dateUpdated": "2026-08-10T11:47:10.756Z", "dateReserved": "2026-08-05T12:23:34.968Z", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "datePublished": "2026-08-05T12:26:30.030Z", "assignerShortName": "TuranSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "fledge", "programFiles": ["python/fledge/services/core/api/backup_restore.py"], "vendor": "fledge-iot", "versions": [{"lessThanOrEqual": "3.1.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Fledge's backup-restore upload handler, upload_backup (python/fledge/services/core/api/backup_restore.py), takes the first extracted tar member's filename (tar_file_names[0]) and builds a shell command via string formatting. Because os.system invokes a shell and no quoting (shlex.quote, list-form subprocess) is applied, an admin uploading a crafted backup archive achieves arbitrary OS command execution."}, {"lang": "es", "value": "El gestor de carga de copia de seguridad y restauraci\u00f3n de Fledge, upload_backup() (python/fledge/services/core/api/backup_restore.py), toma el nombre de archivo del primer miembro tar extra\u00eddo (tar_file_names[0]) y construye un comando de shell mediante formato de cadena: \u2019cmd = \u201ccp {} {}\u201d.format(source, backup_path); ret_code = os.system(cmd)\u2019. La \u00fanica verificaci\u00f3n previa en el nombre de archivo es una coincidencia de prefijo/sufijo (startswith(backup_prefix), endswith(valid_extensions)), que un nombre como \u2019fledge_backup_$(id>/tmp/pwn).db\u2019 satisface mientras sigue inyectando una sustituci\u00f3n de comando de shell. Debido a que os.system() invoca un shell y no se aplica ning\u00fan tipo de entrecomillado (shlex.quote, subprocess en formato de lista), un administrador que carga un archivo de copia de seguridad manipulado logra la ejecuci\u00f3n arbitraria de comandos del sistema operativo."}], "id": "CVE-2026-71284", "lastModified": "2026-10-23T21:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71284", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-05T15:52:35.521988Z", "version": "2.0.3"}}]}, "published": "2026-08-05T13:24:53.093", "references": [{"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "url": "https://github.com/fledge-iot/fledge"}, {"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "url": "https://github.com/fledge-iot/fledge/blob/main/python/fledge/services/core/api/backup_restore.py"}], "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.1.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "fledge", "source": "cna", "vendor": "fledge-iot"}, "product": "fledge", "vendor": "fledge-iot"}], "created": "2026-08-05T15:15:05.783870+00:00", "updated": "2026-08-10T21:30:04.094476+00:00", "vendors": ["fledge-iot", "fledge-iot$PRODUCT$fledge"]}