The vulnerability is in Fledge’s backup‑restore upload handler, where the filename of the first extracted tar member is inserted into a shell command using string formatting without quoting or escaping. Because os.system invokes a shell, an attacker who can upload a backup archive can construct a filename that causes the shell to execute arbitrary commands. This flaw permits arbitrary operating system command execution on the host where the Fledge process runs.

This flaw affects the Fledge IoT Gateway product, specifically the backup_restore.py component of the core API. All installations that have not applied the latest patches and that allow administrators to upload backup archives are vulnerable. The affected version range is not specified in the provided data, so any version prior to a fix should be considered at risk.

The CVSS score of 7.2 indicates a high impact, while the EPSS score of <1% suggests a low probability of exploitation at the moment. The flaw is not currently listed in CISA’s KEV catalog. Successful exploitation requires an attacker who has administrative privileges to upload a backup archive; users lacking such privileges cannot use the feature to execute commands. Once an authenticated administrator uploads a malicious archive, the attacker can run arbitrary commands as the Fledge process user.