CVE-2026-92263

SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, the api/admin/backup/restore endpoint interpolates an uploaded filename into a shell command. An authenticated global administrator uploads a restore archive with a crafted filename. The...

EUVD-2026-102913

SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, the api/admin/backup/restore endpoint interpolates an uploaded filename into a shell command. An authenticated global administrator uploads a restore archive with a crafted filename. The...

CVE-2026-92263 SparkyFitness: Authenticated OS command injection (host RCE) via backup-restore filename in POST /api/admin/backup/restore

SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, the api/admin/backup/restore endpoint interpolates an uploaded filename into a shell command. An authenticated global administrator uploads a restore archive with a crafted filename. The...

CVE-2026-92263

SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, the api/admin/backup/restore endpoint interpolates an uploaded filename into a shell command. An authenticated global administrator uploads a restore archive with a crafted filename. The...

CVE-2026-92263

The SparkyFitness health and fitness tracker is vulnerable to OS command injection in versions prior to 1.6.0 . The flaw exists in the api/admin/backup/restore endpoint, where the application interpolates an uploaded filename directly into a shell command. An authenticated global administrator ca...

CVE-2026-92263 SparkyFitness: Authenticated OS command injection (host RCE) via backup-restore filename in POST /api/admin/backup/restore

SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, the api/admin/backup/restore endpoint interpolates an uploaded filename into a shell command. An authenticated global administrator uploads a restore archive with a crafted filename. The...

CVE-2026-92263 SparkyFitness: Authenticated OS command injection (host RCE) via backup-restore filename in POST /api/admin/backup/restore

SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, the api/admin/backup/restore endpoint interpolates an uploaded filename into a shell command. An authenticated global administrator uploads a restore archive with a crafted filename. The...

PT-2026-115649

Name of the Vulnerable Software and Affected Versions SparkyFitness versions prior to 1.6.0 Description The 'api/admin/backup/restore' endpoint interpolates an uploaded filename into a shell command. An authenticated global administrator can upload a restore archive with a filename containing she...

CVE-2026-92263: Improper Neutralization of Special Elements used in an OS Command

SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, the api/admin/backup/restore endpoint interpolates an uploaded filename into a shell command. An authenticated global administrator uploads a restore archive with a crafted filename. The...

CodeWithCJ SparkyFitness command injection vulnerability

Versions of CodeWithCJ SparkyFitness prior to 1.6.0 have a command injection vulnerability. This vulnerability arises from the API/admin/backup/restore endpoints interpolating the names of uploaded files into shell commands. Certified global administrators can upload recovery archives whose file...