Approved changes feed: RSS · Atom
cpe:2.3:a:fledge-iot:fledge:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Fledge Iot (1793dc86-a3b1-52f6-9084-65d99ec58456) |
|---|---|
| Product | Fledge (1f7aa88f-910d-5e71-b4a3-18a6e28a7db2) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-71283 |
vulnerable | 2026-09-16 04:32:59.720618 |
Fledge IoT Gateway Backup Restore Tar Path Traversal
MEDIUM (4.9)
Fledge's backup-restore upload handler, upload_backup (python/fledge/services/core/api/backup_restore.py), calls tarfile.extractall(temp_path) on an admin-uploaded tar archive with no filter argument and no per-member path validation. Requires the admin role (@has_permission("admin")).
Published: 2026-08-05T12:26:29.146Z
Updated: 2026-08-10T11:47:08.697Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-71284 |
vulnerable | 2026-09-16 04:32:59.384388 |
Fledge IoT Gateway Backup Restore OS Command Injection via Tar Member Filename
HIGH (7.2)
Fledge's backup-restore upload handler, upload_backup (python/fledge/services/core/api/backup_restore.py), takes the first extracted tar member's filename (tar_file_names[0]) and builds a shell command via string formatting. Because os.system invokes a shell and no quoting (shlex.quote, list-form subprocess) is applied, an admin uploading a crafted backup archive achieves arbitrary OS command execution.
Published: 2026-08-05T12:26:30.030Z
Updated: 2026-08-10T11:47:10.756Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.