What is CVE-2026-71284?
This is a critical vulnerability in Fledge's backup-restore functionality. The upload_backup() function builds a shell command using the first extracted tar file's name without sanitization, leading to command injection via the `os.system()` call. If exploited, an attacker can execute arbitrary commands on the system by uploading a malicious tar archive with specially crafted file names.
Azərbaycanca: Bu, Fledge platformasında backup-restore funksiyasında aşkar edilmiş kritik zəiflikdir. upload_backup() funksiyası, tar faylından çıxarılan ilk faylın adını heç bir təmizləmədən `os.system()` çağırışında istifadə edərək əmr inyeksiyasına (command injection) imkan verir. İstismar olunarsa, təcavüzkar xüsusi hazırlanmış fayl adı ilə sistemdə ixtiyari əmrlər icra edə bilər.
Related CVEs
link basis: same weakness class CWE-77
FAQ1
How can an attacker execute arbitrary commands using CVE-2026-71284?
An attacker can exploit the backup-restore functionality by uploading a tar archive with specially crafted file names. Since the upload_backup() function uses the first extracted file's name in an `os.system()` call without sanitization, this leads to command injection.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.