Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.9
CVE-2026-71283: Fledge IoT Gateway Backup Path Traversal Vulnerability
CVE-2026-71283 · published 3 months ago
Summary
Fledge's backup feature allows an admin to write files anywhere on the system. An attacker with admin privileges can exploit this to modify sensitive files or steal data. Update to the latest version of Fledge to fix this issue.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| fledge-iot | fledge | <= 3.1.0 |
Original advisory text
Fledge IoT Gateway Backup Restore Tar Path Traversal
Fledge's backup-restore upload handler, upload_backup (python/fledge/services/core/api/backup_restore.py), calls tarfile.extractall(temp_path) on an admin-uploaded tar archive with no filter argument and no per-member path validation. Requires the admin role (@has_permission("admin")).
References
- https://github.com/fledge-iot/fledge Vendor Advisory
- https://github.com/fledge-iot/fledge/blob/main/python/fledge/services/core/api/b... Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71283... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-71283 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-22Path Traversal
Timeline
Published5 Aug 2026
Updated4 Nov 2026
First seen5 Aug 2026
Track software like this
Free during beta