SparkyFitness EUVD-2026-102913

Exploitation requires an authenticated GLOBAL ADMINISTRATOR account on the SparkyFitness server and access to the api/admin/backup/restore endpoint; the attacker must be able to upload a restore archive AND control its filename, embedding shell metacharacters that the pre-1.6.0 backup/restore code interpolates into a tar shell command. Limiting factors: this is NOT remote-unauthenticated - the highest-level application privilege (global admin) is mandatory, which confines the threat to malicious or compromised administrators (or admin-session/credential theft); no non-default feature toggle is needed since backup/restore is a built-in admin function, but the admin-only gate is the decisive constraint. Affected: all versions prior to 1.6.0; fixed in 1.6.0.

This is a genuine OS command injection (CWE-78) in SparkyFitness's api/admin/backup/restore endpoint, confirmed by the vendor advisory GHSA-jh96-mj9m-x796 and the fix commit 724730b, which replaces shell string interpolation (exec with a tar command built from the uploaded filename) with argument-array execution (execFile) and a server-generated random filename. The provided CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2) is self-consistent: network-reachable HTTP upload, low complexity, no user interaction, full impact via RCE, but critically gated by PR:H - exploitation requires an authenticated GLOBAL ADMINISTRATOR, which is the single largest risk-reducing factor. No EPSS score was supplied, this CVE is NOT in CISA KEV, and no public POC was referenced, so there is no public exploit identified at time of analysis. The practical consequence: an attacker who is already a global admin can escalate from application-level control to arbitrary OS command execution as the server process - a real privilege-boundary break and lateral-movement/persistence enabler - but a remote unauthenticated attacker cannot reach it. Net assessment: a legitimate high-severity bug worth patching, but not an emergency mass-exploitation threat; the PR:H barrier plus the niche, self-hosted deployment footprint keep real-world widespread-exploitation risk low. No signals are internally conflicting; the CVSS vector matches the description (admin-authenticated network upload).

A user who already holds global administrator rights on a SparkyFitness instance uploads a database restore archive whose filename contains shell metacharacters (e.g. backticks or a semicolon). Because the pre-1.6.0 code interpolates that filename directly into a tar shell command, the embedded commands execute with the Node server process's privileges, yielding arbitrary OS command execution on the host. No public proof-of-concept was referenced, and exploitation is low-complexity (AC:L) but requires valid admin authentication (PR:H).