CVE-2026-3089
CVE-2026-3089 · Actual Sync Server 26.2.1 - Authenticated Path Traversal
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Actual Sync Server allows authenticated users to upload files through POST /sync/upload-user-file. In versions prior to 26.3.0, improper validation of the user-controlled x-actual-file-id header means that traversal segments (../) can escape the intended directory and write files outside userFiles.This issue affects prior versions of Actual Sync Server 26.3.0.
CVSS 5.3 · Medium · EPSS 0.4% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
actual sync server
- Versions
- 26.2.1: Affected
No fix published
@actual-app/sync-server npm
- Affected ranges
- SEMVER: < 26.3.0
Update to 26.3.0