fledge-iot vulnerabilities

Products

• fledge 2

Latest fledge-iot CVEs

Newest publication first

1. CVE-2026-71284 Fledge IoT Gateway Backup Restore OS Command Injection via Tar Member Filename

   Published 2026-08-05

   High·CVSS 7.2 EPSS 0.92%

   Fledge's backup-restore upload handler, upload_backup (python/fledge/services/core/api/backup_restore.py), takes the first extracted tar member's filename (tar_file_names[0]) and builds a shell command via string formatting. Because os.system invokes a shell and no quoting (shlex...

2. CVE-2026-71283 Fledge IoT Gateway Backup Restore Tar Path Traversal

   Published 2026-08-05

   Medium·CVSS 4.9 EPSS 0.43%

   Fledge's backup-restore upload handler, upload_backup (python/fledge/services/core/api/backup_restore.py), calls tarfile.extractall(temp_path) on an admin-uploaded tar archive with no filter argument and no per-member path validation. Requires the admin role (@has_permission("adm...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.