This vulnerability in SparkyFitness allows an authenticated global administrator to upload a backup archive with a filename that contains shell metacharacters. The upload endpoint interpolates the filename into an operating‑system shell command, enabling the administrator to execute arbitrary OS commands with the privileges of the server process. The effect is a full remote code execution that can compromise confidentiality, integrity, and availability of the host machine.

Affected systems are installations of SparkyFitness, version 1.6.0 and earlier, where the /api/admin/backup/restore endpoint is available to global administrators. All authenticated global administrators on these installations can exploit the flaw, provided they have access to upload a backup archive.

The CVSS score of 7.2 indicates a high‑severity vulnerability. The EPSS score is not provided, but the flaw requires an authenticated global administrator, limiting the attacker pool to privileged users. The vulnerability is not listed in the CISA KEV catalog. Successful exploitation results in arbitrary command execution on the host, giving the attacker complete control over the system. The attack vector is inferred to be the authenticated HTTP API endpoint for backup restoration, and the weakness is identified as CWE‑78: Improper Neutralization of Input during Runtime Execution.