CVE-2026-71284

The CVE-2026-71284 issue affects Fledge’s backup-restore upload handler (upload_backup) in python/fledge/services/core/api/backup_restore.py. The handler takes the first extracted tar member’s filename and builds a shell command via string formatting: cmd = "cp {} {}". Since only a prefix/suffix ...