CVE-2026-3089: Actual Sync Server has an Authenticated Path Traversal
Actual Sync Server allows authenticated users to upload files through POST /sync/upload-user-file. In versions prior to 26.3.0, improper validation of the user-controlled x-actual-file-id header means that traversal segments (../) can escape the intended directory and write files outside userFiles.
References
- fluidattacks.com/advisories/fugue
- github.com/actualbudget/actual
- github.com/actualbudget/actual/commit/18072e1d8b5281db43ded8b21433ee177bae9dfa
- github.com/actualbudget/actual/pull/7067
- github.com/actualbudget/actual/security/advisories/GHSA-27vg-33gh-4hwg
- github.com/advisories/GHSA-27vg-33gh-4hwg
- nvd.nist.gov/vuln/detail/CVE-2026-3089
Code Behaviors & Features
Detect and mitigate CVE-2026-3089 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →