CVE-2026-71283: Fledge IoT Gateway Backup Restore Tar Path Traversal
Fledge's backup-restore upload handler, uploadbackup() (python/fledge/services/core/api/backuprestore.py), calls tarfile.extractall(temppath) on an admin-uploaded tar archive with no filter argument and no per-member path validation. A crafted tar archive containing member names with ../ path components extracts files outside the intended temporary directory, allowing arbitrary file writes anywhere on the filesystem reachable by the Fledge process. Requires the admin role (@haspermission("admin")).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71283?
The severity of CVE-2026-71283 is classified as medium with a score of 4.9.
How do I fix CVE-2026-71283?
To fix CVE-2026-71283, apply path validation and filtering to the tar extraction process in the backup-restore upload handler.
What type of vulnerability is CVE-2026-71283?
CVE-2026-71283 is a path traversal vulnerability affecting the Fledge IoT Gateway.
Which software is impacted by CVE-2026-71283?
CVE-2026-71283 impacts the Fledge IoT Gateway software.
When was CVE-2026-71283 published?
CVE-2026-71283 was published on August 5, 2026.