CVE-2026-92263

SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, the api/admin/backup/restore endpoint interpolates an uploaded filename into a shell command. An authenticated global administrator uploads a restore archive with a crafted filename. The administrator can supply a restore archive with a filename containing shell metacharacters. Successful exploitation can execute arbitrary operating-system commands with the server process privileges. This issue is fixed in version 1.6.0.

• CWE-78

• https://github.com/CodeWithCJ/SparkyFitness/commit/724730b6de5f2ca46856e0cbf113cc34f9c0689d
• https://github.com/CodeWithCJ/SparkyFitness/releases/tag/v1.6.0
• https://github.com/CodeWithCJ/SparkyFitness/security/advisories/GHSA-jh96-mj9m-x796
• https://github.com/CodeWithCJ/SparkyFitness/security/advisories/GHSA-jh96-mj9m-x796

Published

Oct 16, 2026

Last Modified

Oct 21, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-92255Netcore NR255-V version 1.5.130703 contains an out-of-bounds…5.4
• CVE-2026-92256NR255-V version 1.5.130703 contains a sensitive information …6.5
• CVE-2026-92257Netcore NR255-V version 1.5.130703 contains a stored cross-s…5.4
• CVE-2026-92259Integer overflow or wraparound vulnerability in Samsung Open…5.5
• CVE-2026-9226Authentication bypass in the Azure AD external login flow in…6.8
• CVE-2026-92262MariaDB server is a community developed fork of MySQL server…9.9
• CVE-2026-9227The GutenBee – Gutenberg Blocks plugin for WordPress is vuln…8.8
• CVE-2026-9228The Timetable and Event Schedule by MotoPress plugin for Wor…4.3
• CVE-2026-92284Caddy is an extensible server platform that uses TLS by defa…6.9
• CVE-2026-92287Pass-through of unvalidated KMS URLs to KMS clients in Apach…8.1
• CVE-2026-92288Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, fr…9.1
• CVE-2026-92289Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for…9.1