CVE-2026-71283 in Fledge
Summary
by MITRE • 08/05/2026
Fledge's backup-restore upload handler, upload_backup() (python/fledge/services/core/api/backup_restore.py), calls tarfile.extractall(temp_path) on an admin-uploaded tar archive with no filter argument and no per-member path validation. A crafted tar archive containing member names with `../` path components extracts files outside the intended temporary directory, allowing arbitrary file writes anywhere on the filesystem reachable by the Fledge process. Requires the admin role (@has_permission("admin")).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/06/2026
The vulnerability exists within Fledge's backup and restore functionality where the upload_backup() method processes administrator-uploaded tar archives without adequate validation or sanitization of archive member paths. This flaw stems from the direct invocation of tarfile.extractall(temp_path) without specifying a filter argument or implementing per-member path validation, creating an arbitrary file write condition that can be exploited by authenticated administrators. The vulnerability is classified as a directory traversal issue under CWE-22 and represents a critical security weakness in the application's input handling mechanisms.
The technical implementation of this vulnerability allows attackers with administrative privileges to craft malicious tar archives containing member names that include ../ path components. When the tarfile.extractall() method processes these archives, it extracts files outside the intended temporary directory specified by temp_path, potentially writing files anywhere within the filesystem that is accessible to the Fledge process. This occurs because Python's tarfile module, when used without a filter argument, permits extraction of members with absolute paths or paths containing parent directory references, effectively bypassing directory restrictions.
The operational impact of this vulnerability is severe as it enables authenticated attackers to perform arbitrary file writes on the target system, potentially leading to privilege escalation, data corruption, or persistent backdoor installation. An attacker could leverage this vulnerability to overwrite critical system files, inject malicious code into running processes, or establish unauthorized access points within the Fledge service environment. The attack requires only administrative privileges which are typically restricted to trusted personnel but represent a significant risk when compromised.
Mitigation strategies should focus on implementing proper path validation and sanitization of tar archive members before extraction. The recommended approach involves using Python's tarfile module with a filter argument or implementing custom path validation logic that rejects any member names containing parent directory references. Additionally, the temporary extraction directory should be created with restrictive permissions, and all extracted files should undergo verification against expected paths before being moved to their final destinations. This vulnerability highlights the importance of following secure coding practices as outlined in the OWASP Secure Coding Practices and aligns with ATT&CK technique T1059 for execution through command-line interfaces, emphasizing the need for input validation controls in web applications handling file uploads.