CVE-2026-71283 Details

A vulnerability in Fledge's backup-restore upload handler allows for arbitrary file writes on the filesystem. The issue arises because the upload_backup() function in the backup_restore.py file does not properly validate the contents of tar archives uploaded by admins. When an admin uploads a tar file, the function extracts it using tarfile.extractall() without any filters or path validation. This lack of oversight enables the extraction of files to locations outside the designated temporary directory, potentially overwriting critical system files or introducing malicious ones. The vulnerability requires admin privileges to exploit.