Arbitrary Command Execution in Fledge Backup-Restore Functionality

CVE-2026-71284

What is CVE-2026-71284?

Fledge's backup-restore functionality contains a security flaw that allows an attacker to execute arbitrary commands on the operating system. The issue arises from improper handling of filenames when restoring backup archives. The method responsible, upload_backup(), constructs a shell command without adequate validation of the extracted filename, which only checks for specific prefixes and valid extensions. This inadequate sanitization allows for command substitution, enabling an attacker to upload a maliciously crafted backup archive that, when processed, executes arbitrary OS commands. As a result, administrators may inadvertently compromise the integrity and security of the system.

References