The vulnerability occurs in fledge's upload_backup handler (python/fledge/services/core/api/backup_restore.py), where the first filename extracted from a tar archive is directly embedded into a shell command string executed via os.system. Because os.system invokes a shell and no safe quoting or subprocess list form is used, an attacker with admin privileges can craft a backup archive to achieve arbitrary OS command execution. This is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command).

An attacker with administrative privileges who can upload backup archives can execute arbitrary commands on the host operating system with the privileges of the fledge process. This can lead to full system compromise, data loss, or disruption of service. The CVSS v3.1 base score is 7.2 (High), reflecting network attack vector, low attack complexity, required high privileges, no user interaction, and high impact on confidentiality, integrity, and availability.

No official patch or remediation guidance is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, administrators should avoid uploading untrusted backup archives and consider restricting access to the backup-restore functionality to trusted users only.