https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T02:20:51.746550+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-349674 EUVD-2026-349674 2026-10-07T02:20:51.748583+00:00 EUVD-2026-349674 https://cve.radiocsirt.org/vuln/fkie_cve-2026-71283 fkie_cve-2026-71283 2026-10-07T02:20:51.748617+00:00

Fledge's backup-restore upload handler, upload_backup (python/fledge/services/core/api/backup_restore.py), calls tarfile.extractall(temp_path) on an admin-uploaded tar archive with no filter argument and no per-member path validation. Requires the admin role (@has_permission("admin")).

 https://cve.radiocsirt.org/vuln/ghsa-qc6r-chrx-m659 GHSA-qc6r-chrx-m659 2026-10-07T02:20:51.748649+00:00

Fledge's backup-restore upload handler, upload_backup() (python/fledge/services/core/api/backup_restore.py), calls tarfile.extractall(temp_path) on an admin-uploaded tar archive with no filter argument and no per-member path validation. A crafted tar archive containing member names with `../` path components extracts files outside the intended temporary directory, allowing arbitrary file writes anywhere on the filesystem reachable by the Fledge process. Requires the admin role (@has_permission("admin")).