CVE-2026-92263

HighCVSS 7.2

Published: 16/10/2026(UTC)Updated: 16/10/2026(UTC)Translated: 16/10/2026(UTC)NVD NIST

Summary

In SparkyFitness, the api/admin/backup/restore endpoint interpolates an uploaded filename into a shell command. An authenticated global administrator can upload a restore archive with a crafted filename containing shell metacharacters, allowing execution of arbitrary OS commands with server process privileges.

Risk Assessment

An attacker with administrator privileges can execute arbitrary OS commands, leading to full server compromise. The risk includes system takeover and data access.

Recommendation

Update SparkyFitness to version 1.6.0 or later. Restrict access to the restore endpoint and validate filenames before processing.

Other vulnerabilities in SparkyFitness

CVE-2026-102923Medium
In SparkyFitness prior to 1.6.0, chatService.ts and labelScanService.ts do not validate destinations supplied in custom AI service settings. An authenticated user can save a custom AI service URL and invoke an affected AI flow, triggering an outbound request with a controlled bearer value.

Original NVD description (English source)

SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, the api/admin/backup/restore endpoint interpolates an uploaded filename into a shell command. An authenticated global administrator uploads a restore archive with a crafted filename. The administrator can supply a restore archive with a filename containing shell metacharacters. Successful exploitation can execute arbitrary operating-system commands with the server process privileges. This issue is fixed in version 1.6.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS