CVE-2026-92263 in SparkyFitness
Summary
by MITRE • 10/16/2026
SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, the api/admin/backup/restore endpoint interpolates an uploaded filename into a shell command. An authenticated global administrator uploads a restore archive with a crafted filename. The administrator can supply a restore archive with a filename containing shell metacharacters. Successful exploitation can execute arbitrary operating-system commands with the server process privileges. This issue is fixed in version 1.6.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified in SparkyFitness versions prior to 1.6.0 represents a critical security flaw classified as OS Command Injection, specifically mapped to CWE-78 within the Common Weakness Enumeration framework. This weakness occurs when an application constructs a command string for execution by an operating system shell using data that is influenced by user input without proper validation or sanitization. In this specific instance, the vulnerability resides in the api/admin/backup/restore endpoint, which handles the restoration of backup archives. The core technical failure lies in the backend logic that interpolates the uploaded filename directly into a shell command string. By failing to escape or validate special characters within the filename parameter, the application allows an attacker to inject arbitrary commands that are subsequently executed by the system shell with the privileges of the running SparkyFitness process.
The operational impact of this vulnerability is severe due to its potential for complete system compromise. An authenticated global administrator can exploit this flaw by uploading a restore archive file with a crafted filename containing shell metacharacters, such as semicolons, pipes, or backticks. Upon processing this request, the server executes these injected commands rather than treating them as literal characters in the filename. This allows an attacker to execute arbitrary operating-system commands on the host machine. Depending on the configuration and privileges of the SparkyFitness service account, this could lead to unauthorized access to sensitive data stored within the application's database or file system, modification of critical system files, installation of backdoors for persistent access, or even using the compromised server as a pivot point for further attacks against other systems in the network. This aligns with ATT&CK technique T1059, Command and Scripting Interpreter, which describes how adversaries use command-line interfaces to execute malicious code on victim machines.
To mitigate this vulnerability, it is imperative that organizations running SparkyFitness upgrade immediately to version 1.6.0 or later, where the issue has been resolved through proper input validation and secure coding practices. For environments where upgrading is not immediately feasible, temporary mitigations should include restricting access to the admin interface using strong authentication mechanisms and network segmentation to limit exposure of administrative endpoints. Additionally, implementing a Web Application Firewall with rules designed to detect shell injection patterns in file upload parameters can provide an additional layer of defense. Long-term remediation strategies must emphasize secure coding standards that strictly avoid passing unsanitized user input directly into system commands, preferring instead to use parameterized APIs or safe library functions for file operations and process execution whenever possible.