CVE-2026-3089
Medium · 6.5CVSS
6.5
EPSS
0.5%
Published
Mar 9, 2026
CISA due date
—
The record
Actual Sync Server allows authenticated users to upload files through POST /sync/upload-user-file. In versions prior to 26.3.0, improper validation of the user-controlled x-actual-file-id header means that traversal segments (../) can escape the intended directory and write files outside userFiles.This issue affects prior versions of Actual Sync Server 26.3.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @actual-app/sync-server | 0 | 26.3.0 |
Related vulnerabilities
- GHSA-27vg-33gh-4hwg Actual Sync Server has an Authenticated Path Traversal Same vulnerability
- CVE-2026-33318 Actual is a local-first personal finance tool. Also affects @actual-app/sync-server
- GHSA-prp4-2f49-fcgp Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers Also affects @actual-app/sync-server
- GHSA-qmjj-p7m9-wjrv @actual-app/sync-server: Missing authorization in sync endpoints allows cross-user budget… Also affects @actual-app/sync-server
- CVE-2026-27638 Actual is a local-first personal finance tool. Also affects @actual-app/sync-server
- GHSA-m2cq-xjgm-f668 ActualBudget server is Missing Authentication for SimpleFIN and Pluggy AI bank sync… Also affects @actual-app/sync-server
- CVE-2026-27584 Actual is a local-first personal finance tool. Also affects @actual-app/sync-server
- CVE-2026-81163 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')… CWE-22