# CVE-2026-92263: SparkyFitness command injection in backup restore endpoint

Source: https://junglewise.ai/threats/cve-2026-92263-sparkyfitness-is-a-self-hosted-ai-powered-health-and-fitness  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-16. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-92263 · Severity: high · CVSS 7.2 · Published 2026-10-16

SparkyFitness is a self-hosted AI-powered family fitness tracker. The backup restore feature unsafely passes uploaded filenames to shell commands, allowing an authenticated administrator to execute arbitrary operating-system commands on the server by uploading a restore archive with a specially crafted filename. This could lead to complete server compromise and access to all user health data.

Technologies: [CodeWithCJ SparkyFitness](https://junglewise.ai/threats/technologies/sparkyfitness). Vendors: [CodeWithCJ](https://junglewise.ai/threats/vendors/codewithcj).

## Quick answers

**Is CVE-2026-92263 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92263 being exploited in the wild.

**How severe is CVE-2026-92263?** High severity, with a CVSS score of 7.2, published 16 October 2026.

**Which products and versions are affected?** CodeWithCJ SparkyFitness before 1.6.0.

**Is there a fix for CVE-2026-92263?** Yes: fixed in 1.6.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-92263 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-92263?** Check whether you run CodeWithCJ SparkyFitness at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.6.0

## Technical details

The api/admin/backup/restore endpoint interpolates an uploaded filename directly into a shell command without proper escaping. An authenticated global administrator can exploit this command injection by uploading a restore archive with shell metacharacters in the filename. The fix in version 1.6.0 replaces shell-based execution with argv-based execFile to prevent metacharacter interpretation.

## Affected products

- CodeWithCJ SparkyFitness before 1.6.0

## Timeline

- 2026-07-09: patched
- 2026-10-16: disclosed

## References

- [https://github.com/CodeWithCJ/SparkyFitness/commit/724730b6de5f2ca46856e0cbf113cc34f9c0689d](https://github.com/CodeWithCJ/SparkyFitness/commit/724730b6de5f2ca46856e0cbf113cc34f9c0689d)
- [https://github.com/CodeWithCJ/SparkyFitness/releases/tag/v1.6.0](https://github.com/CodeWithCJ/SparkyFitness/releases/tag/v1.6.0)

## Related threats

- [SparkyFitness missing authorization in food variant deletion](https://junglewise.ai/threats/cve-2026-113612-sparkyfitness-before-0-17-0-contains-a-missing-authorization)
- [SparkyFitness server-side request forgery in AI service settings](https://junglewise.ai/threats/cve-2026-102923-sparkyfitness-is-a-self-hosted-ai-powered-health-and-fitness)