CVE-2026-92263 — SparkyFitness: Authenticated OS command injection (host RCE) via backup-restore filename in POST /api/admin/backup/rest…

CVE-2026-92263 describes an authenticated OS command injection in SparkyFitness via a backup-restore filename, potentially resulting in host RCE.