GHSA-27vg-33gh-4hwg
NoneCVSS
—
EPSS
—
Published
Mar 10, 2026
CISA due date
—
The record
Actual Sync Server has an Authenticated Path Traversal
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @actual-app/sync-server | 0 | 26.3.0 |
Related vulnerabilities
- CVE-2026-3089 Actual Sync Server allows authenticated users to upload files through POST… Same vulnerability
- CVE-2026-33318 Actual is a local-first personal finance tool. Also affects @actual-app/sync-server
- GHSA-prp4-2f49-fcgp Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers Also affects @actual-app/sync-server
- GHSA-qmjj-p7m9-wjrv @actual-app/sync-server: Missing authorization in sync endpoints allows cross-user budget… Also affects @actual-app/sync-server
- CVE-2026-27638 Actual is a local-first personal finance tool. Also affects @actual-app/sync-server
- GHSA-m2cq-xjgm-f668 ActualBudget server is Missing Authentication for SimpleFIN and Pluggy AI bank sync… Also affects @actual-app/sync-server
- CVE-2026-27584 Actual is a local-first personal finance tool. Also affects @actual-app/sync-server
- CVE-2026-81163 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')… CWE-22