CVE-2026-92263: SparkyFitness: Authenticated OS command injection (host RCE) via backup-restore filename in POST /api/admin/backup/restore
SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, the api/admin/backup/restore endpoint interpolates an uploaded filename into a shell command. An authenticated global administrator uploads a restore archive with a crafted filename. The administrator can supply a restore archive with a filename containing shell metacharacters. Successful exploitation can execute arbitrary operating-system commands with the server process privileges. This issue is fixed in version 1.6.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SparkyFitnessto a version that resolves this vulnerability.Fixed in 1.6.0
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires authentication as a global administrator. An unauthenticated user is not described as able to reach the vulnerable restore operation.
What does an attacker need to provide?
The attacker must upload a backup restore archive to POST /api/admin/backup/restore and give it a filename containing shell metacharacters. The filename is interpolated into a shell command.
What level of access can successful exploitation provide?
Successful exploitation can run arbitrary operating-system commands with the privileges of the SparkyFitness server process. The impact includes confidentiality, integrity, and availability consequences at that privilege level.
Which deployments are affected and what is the fix?
Versions prior to 1.6.0 are affected. Upgrade to version 1.6.0, which fixes the issue.