The vulnerability resides in Fledge’s backup‑restore upload handler, which calls tarfile.extractall on an uploaded tar archive without filtering or path validation, constituting a classic CWE‑22 path traversal weakness. A crafted archive can contain filenames such as "../" that cause the extraction routine to write files outside the intended temporary directory. This allows an administrator‑level user to write arbitrary files anywhere accessible to the Fledge process, potentially leading to configuration tampering, credential leakage, or further exploitation of the system. The prior description was updated, but the described vulnerability and its impact remain consistent with this analysis.

All releases of the Fledge IoT Gateway that include the backup‑restore API endpoint in the core services. The exact version is unspecified, so any installation that has not applied a patch to the upload_backup() function is susceptible.

The CVSS score of 4.9 indicates a moderate severity. The EPSS score is < 1%, suggesting a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with the "admin" role, as enforced by @has_permission("admin"). Once the path traversal is abused, the attacker can write files with the permissions of the Fledge process, giving them significant local impact. While the vector is limited to users who can access the admin API, the impact on confidentiality, integrity, and availability is substantial if the adversary gains those privileges.