CVE-2026-71284 describes an OS command injection vulnerability in the Fledge IoT data platform's backup-restore upload handler (upload_backup() in backup_restore.py). The vulnerable code constructs a shell command using Python string formatting with an unsanitized tar archive member filename, then executes it via os.system(). The only validation applied is a prefix and suffix check on the filename, which can be trivially bypassed using shell command substitution syntax (e.g., fledge_backup_$(id>/tmp/pwn).db). Since os.system() invokes a shell interpreter and no proper quoting (shlex.quote or list-form subprocess) is used, a malicious admin or attacker with upload privileges can achieve arbitrary OS command execution on the host. The vulnerability is classified as high severity due to its potential for full system compromise. Remediation requires replacing os.system() with safe subprocess calls using list arguments and applying shlex.quote or equivalent sanitization to filenames.