Arbitrary Command Execution Vulnerability in SparkyFitness Health Tracker
CVE-2026-92263

7.2HIGH

Key Information:

Vendor: Codewithcj
Status: Sparkyfitness
Vendor: CVE Published:; 16 October 2026

What is CVE-2026-92263?

SparkyFitness, an AI-powered health and fitness tracker, has a vulnerability in the api/admin/backup/restore endpoint. Prior to version 1.6.0, this endpoint improperly interpolates an uploaded filename into a shell command. If an authenticated global administrator uploads a restore archive with a maliciously crafted filename containing shell metacharacters, it can lead to the execution of arbitrary operating-system commands with elevated privileges. This critical issue has been addressed in version 1.6.0.