CVE-2026-92263

7.2 Élevée

Publiée le 16/10/2026 à 18:22 · Modifiée le 21/10/2026 à 05:17 · Analyse NVD reportée · Source : security-advisories@github.com

Description

SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, the api/admin/backup/restore endpoint interpolates an uploaded filename into a shell command. An authenticated global administrator uploads a restore archive with a crafted filename. The administrator can supply a restore archive with a filename containing shell metacharacters. Successful exploitation can execute arbitrary operating-system commands with the server process privileges. This issue is fixed in version 1.6.0.

Traduire en français

Produits concernés

CodeWithCJ SparkyFitness

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.2 Élevée	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-78

Références

https://github.com/CodeWithCJ/SparkyFitness/commit/724730b6de5f2ca46856e0cbf113cc34f9c0689d
https://github.com/CodeWithCJ/SparkyFitness/releases/tag/v1.6.0
https://github.com/CodeWithCJ/SparkyFitness/security/advisories/GHSA-jh96-mj9m-x796
https://github.com/CodeWithCJ/SparkyFitness/security/advisories/GHSA-jh96-mj9m-x796

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories