Live › vulnerability › CVE-2026-92263
Go to dashboardSparkyFitness, a self-hosted health tracker, builds a shell command from the uploaded restore archive's filename on its admin backup restore endpoint. An authenticated global administrator can embed shell metacharacters in the filename and run arbitrary operating-system commands with the server process's privileges.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted SparkyFitness instances running a version before are exposed. The attack needs a global administrator account, so the risk sits with whoever can log in as an admin on the instance. Teams using only non-admin accounts on a patched build can skip it.
1.6.0No product ranges from the sources yet.
1.6.0 are affected.api/admin/backup/restore endpoint and who holds global administrator accounts.1.6.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, the api/admin/backup/restore endpoint interpolates an uploaded filename into a shell command. An authenticated global administrator uploads a restore archive with a crafted filename. The administrator can supply a restore archive with a filename containing shell metacharacters. Successful exploitation can execute arbitrary operating-system commands with the server process privileges. This issue is fixed in version 1.6.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-92263")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.