CVE-2026-71283: Fledge-IoT Fledge

Medium severity, CVSS 4.9. EPSS: 0.4% chance of exploitation in the next 30 days.

Fledge's backup-restore upload handler, upload_backup (python/fledge/services/core/api/backup_restore.py), calls tarfile.extractall(temp_path) on an admin-uploaded tar archive with no filter argument and no per-member path validation. Requires the admin role (@has_permission("admin")).

Affected products

• Fledge-IoT Fledge: up to and including 3.1.0

Published 2026-08-05. Last modified 2026-08-26.