Fledge
Monthly
Command injection in Fledge's backup-restore upload handler allows an authenticated administrator to execute arbitrary OS commands on the underlying host by uploading a crafted tar archive. The vulnerable function upload_backup() in python/fledge/services/core/api/backup_restore.py constructs a shell command via unsanitized string formatting and passes it directly to os.system(), while filename validation only checks prefix and suffix - a filename such as fledge_backup_$(id>/tmp/pwn).db satisfies both checks while embedding a shell command substitution. CVSS 7.2 (PR:H) reflects the admin privilege prerequisite; no public exploit or CISA KEV listing has been identified at time of analysis, but the technique is trivially reproducible given access.
Arbitrary file write via tar path traversal in Fledge's backup-restore API allows an authenticated admin to overwrite files anywhere on the host filesystem reachable by the Fledge process. The upload_backup() handler in backup_restore.py calls Python's tarfile.extractall() without a filter argument or member-path sanitization, enabling a classic 'tar slip' attack. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the attack is mechanically trivial for any actor holding admin credentials.
Command injection in Fledge's backup-restore upload handler allows an authenticated administrator to execute arbitrary OS commands on the underlying host by uploading a crafted tar archive. The vulnerable function upload_backup() in python/fledge/services/core/api/backup_restore.py constructs a shell command via unsanitized string formatting and passes it directly to os.system(), while filename validation only checks prefix and suffix - a filename such as fledge_backup_$(id>/tmp/pwn).db satisfies both checks while embedding a shell command substitution. CVSS 7.2 (PR:H) reflects the admin privilege prerequisite; no public exploit or CISA KEV listing has been identified at time of analysis, but the technique is trivially reproducible given access.
Arbitrary file write via tar path traversal in Fledge's backup-restore API allows an authenticated admin to overwrite files anywhere on the host filesystem reachable by the Fledge process. The upload_backup() handler in backup_restore.py calls Python's tarfile.extractall() without a filter argument or member-path sanitization, enabling a classic 'tar slip' attack. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the attack is mechanically trivial for any actor holding admin credentials.