CVE-2026-92263 Details
Description
SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, the api/admin/backup/restore endpoint interpolates an uploaded filename into a shell command. An authenticated global administrator uploads a restore archive with a crafted filename. The administrator can supply a restore archive with a filename containing shell metacharacters. Successful exploitation can execute arbitrary operating-system commands with the server process privileges. This issue is fixed in version 1.6.0.
A command injection vulnerability has been identified in SparkyFitness versions prior to 1.6.0. The issue arises in the api/admin/backup/restore endpoint, where an authenticated global administrator can upload a restore archive with a crafted filename. This filename is interpolated into a shell command, allowing for the execution of arbitrary operating system commands with the privileges of the server process. The vulnerability is rooted in the improper handling of user-supplied filenames, which can include shell metacharacters that are not adequately sanitized before being executed.
Users are advised to update SparkyFitness to version 1.6.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 16, 2026CISA-ADP
Assessed Oct 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/CodeWithCJ/SparkyFitness/security/advisories/GHSA-jh96-mj9m-x796 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/CodeWithCJ/SparkyFitness/commit/724730b6de5f2ca46856e0cbf113cc34f9c0689d | [email protected] | Source CodeVendor |
| https://github.com/CodeWithCJ/SparkyFitness/releases/tag/v1.6.0 | [email protected] | Release NotesVendor |
| https://github.com/CodeWithCJ/SparkyFitness/security/advisories/GHSA-jh96-mj9m-x796 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| CodeWithCJ SparkyFitness | <= 0.17.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 21, 2026 | CVE Modified | CISA-ADP |
| Oct 16, 2026 | New CVE Received | [email protected] |