SparkyFitness vulnerabilities
CVEs whose affected-version data names the SparkyFitness package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-102923Medium· 5.4SparkyFitness: SSRF via unvalidated custom_url in AI service settings
SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, SparkyFitnessServer/services/chatService.ts and SparkyFitnessServer/services/labelScanService.ts do not validate destinations supplied in…
▾ SunlitCodeWithCJ · SparkyFitnessvia CVEORG
CVE-2026-92263High· 7.2SparkyFitness: Authenticated OS command injection (host RCE) via backup-restore filename in POST /api/admin/backup/restore
SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, the api/admin/backup/restore endpoint interpolates an uploaded filename into a shell command. An authenticated global administrator uploa…
▾ TwilightCodeWithCJ · SparkyFitnessvia CVEORG