What is the CVSS score of CVE-2026-71284?

CVE-2026-71284 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.9%.

Which versions of Fledge IoT are affected by CVE-2026-71284?

Fledge's backup-restore functionality contains a command injection vulnerability allowing any administrator to execute arbitrary operating system commands and compromise the underlying host system.

How to fix or mitigate CVE-2026-71284?

Within 24 hours, restrict the backup-restore API endpoint to a minimal set of trusted administrators and enable detailed audit logging of all backup upload and restore operations. Within 7 days, review administrative account activity from the past 90 days for suspicious backup file uploads, and implement or enforce multi-factor authentication on all administrator accounts with backup-restore access. Within 30 days, contact Fledge maintainers to obtain patch timeline estimates, conduct a business impact assessment of alternative edge computing platforms without this vulnerability, and establish ongoing monitoring with alerting rules configured to detect suspicious filenames containing shell metacharacters ($, `, |, ;, &).

Fledge IoT CVE-2026-71284

EUVD-2026-53369 HIGH

OS Command Injection (CWE-78)

2026-08-05 TuranSec

GHSA-6h3f-43g6-3hqh

Python Command Injection Fledge Fledge Iot

7.2

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network-accessible API (AV:N), trivial filename crafting (AC:L), admin credentials required per description (PR:H), arbitrary command execution yields full CIA impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 13:44 vuln.today

CVE Published

Aug 05, 2026 - 12:26 cve.org

HIGH 7.2

DescriptionCVE.org

Fledge's backup-restore upload handler, upload_backup() (python/fledge/services/core/api/backup_restore.py), takes the first extracted tar member's filename (tar_file_names[0]) and builds a shell command via string formatting: cmd = "cp {} {}".format(source, backup_path); ret_code = os.system(cmd). The only pre-check on the filename is a prefix/suffix match (startswith(backup_prefix), endswith(valid_extensions)), which a name such as fledge_backup_$(id>/tmp/pwn).db satisfies while still injecting a shell command substitution. Because os.system() invokes a shell and no quoting (shlex.quote, list-form subprocess) is applied, an admin uploading a crafted backup archive achieves arbitrary OS command execution.

AnalysisAI

Command injection in Fledge's backup-restore upload handler allows an authenticated administrator to execute arbitrary OS commands on the underlying host by uploading a crafted tar archive. The vulnerable function upload_backup() in python/fledge/services/core/api/backup_restore.py constructs a shell command via unsanitized string formatting and passes it directly to os.system(), while filename validation only checks prefix and suffix - a filename such as fledge_backup_$(id>/tmp/pwn).db satisfies both checks while embedding a shell command substitution. CVSS 7.2 (PR:H) reflects the admin privilege prerequisite; no public exploit or CISA KEV listing has been identified at time of analysis, but the technique is trivially reproducible given access.

Technical ContextAI

Fledge is an open-source IIoT data historian and edge processing platform (cpe:2.3:a:fledge-iot:fledge:*:*:*:*:*:*:*:*). The flaw resides in the Python REST API layer at python/fledge/services/core/api/backup_restore.py. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), specifically the pattern: cmd = 'cp {} {}'.format(source, backup_path) followed by os.system(cmd). Python's os.system() invokes /bin/sh -c, which interprets shell metacharacters including $() command substitution, backticks, semicolons, and pipes. The only guard - a startswith()/endswith() check on the tar member's filename - is a classic allowlist bypass; it checks prefix and suffix independently, leaving the middle of the string entirely unvalidated. The correct remediation pattern would use shlex.quote() on all interpolated paths, or preferably replace os.system() with subprocess.run() in list form (e.g., ['cp', source, backup_path]) which never invokes a shell.

RemediationAI

The primary fix is to replace the os.system() string-formatting pattern with either shlex.quote() applied to all user-controlled path components before interpolation, or - preferably - the list-form subprocess.run(['cp', source, backup_path], check=True) which bypasses the shell entirely and eliminates the injection surface. The fix must be applied to the upload_backup() function in python/fledge/services/core/api/backup_restore.py; review adjacent functions in the same file for the same anti-pattern. Until a patched release is available (no fixed version confirmed at time of analysis; track https://github.com/fledge-iot/fledge for releases), compensating controls include: restricting access to the Fledge REST API to a dedicated operations network segment rather than broad LAN/WAN exposure; enforcing multi-factor authentication or strong credential controls on administrator accounts; and auditing which accounts hold admin privileges to minimize the blast radius of credential compromise. Disabling the backup-restore upload endpoint entirely is the most effective workaround if that feature is not operationally required.