CVE-2026-92263
7.2HighPublished 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-78
Impact
Authenticated global administrators can execute arbitrary operating-system commands with the privileges of the server process. They need valid high-privilege credentials to upload a crafted backup archive.
Root cause
The backup restore API endpoint interpolates untrusted uploaded filenames directly into a shell command without sanitization.
Affected systems
SparkyFitness prior to version 1.6.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade SparkyFitness to version 1.6.0 or later. If patching immediately is not possible, restrict network access to the admin interface or disable the backup restore endpoint.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, the api/admin/backup/restore endpoint interpolates an uploaded filename into a shell command. An authenticated global administrator uploads a restore archive with a crafted filename. The administrator can supply a restore archive with a filename containing shell metacharacters. Successful exploitation can execute arbitrary operating-system commands with the server process privileges. This issue is fixed in version 1.6.0.