CVE-2026-3089

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-3089
Actual Sync Server allows authenticated users to upload files through POST /sync/upload-user-file. In versions prior to 26.3.0, improper validation of the user-controlled x-actual-file-id header means that traversal segments (../) can escape the intended directory and write files outside userFiles.This issue affects prior versions of Actual Sync Server 26.3.0.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://fluidattacks.com/advisories/fugue Exploit Third Party Advisory
https://github.com/actualbudget/actual Product
https://github.com/actualbudget/actual/pull/7067 Issue Tracking Patch
https://fluidattacks.com/advisories/fugue Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:actualbudget:actual:*:*:*:*:*:node.js:*:*
History

09 Apr 2026, 21:01

Type Values Removed Values Added
References () https://fluidattacks.com/advisories/fugue - () https://fluidattacks.com/advisories/fugue - Exploit, Third Party Advisory
References () https://github.com/actualbudget/actual - () https://github.com/actualbudget/actual - Product
References () https://github.com/actualbudget/actual/pull/7067 - () https://github.com/actualbudget/actual/pull/7067 - Issue Tracking, Patch
First Time Actualbudget
Actualbudget actual
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5
CPE cpe:2.3:a:actualbudget:actual:*:*:*:*:*:node.js:*:*

11 Mar 2026, 13:53

Type Values Removed Values Added
Summary
  • (es) Actual Sync Server permite a usuarios autenticados subir archivos a través de POST /sync/upload-user-file. En versiones anteriores a la 26.3.0, una validación incorrecta del encabezado x-actual-file-id controlado por el usuario significa que los segmentos de recorrido (../) pueden escapar del directorio previsto y escribir archivos fuera de userFiles. Este problema afecta a versiones anteriores de Actual Sync Server 26.3.0.

09 Mar 2026, 15:15

Type Values Removed Values Added
References () https://fluidattacks.com/advisories/fugue - () https://fluidattacks.com/advisories/fugue -

09 Mar 2026, 14:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-09 14:16

Updated : 2026-04-09 21:01

NVD link : CVE-2026-3089

Mitre link : CVE-2026-3089

CVE.ORG link : CVE-2026-3089

JSON object : View

Products Affected

actualbudget

  • actual
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')