GHSA-27vg-33gh-4hwg

Actual Sync Server has an Authenticated Path Traversal

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-3089

Packages

Ecosystem	Package	Affected	Fixed in
npm	@actual-app/sync-server	< 26.3.0	26.3.0

Details

As written in the advisory (Markdown source, shown as plain text).

# Description Actual Sync Server allows authenticated users to upload files through `POST /sync/upload-user-file`. In versions prior to 26.3.0, improper validation of the user-controlled `x-actual-file-id` header means that traversal segments (`../`) can escape the intended directory and write files outside `userFiles`. ## Mitigations The vulnerability can be mitigated in prior versions by running the sync server in a filesystem sandbox.

References

External links from the advisory. They lead to third-party sites.

https://github.com/actualbudget/actual/security/advisories/GHSA-27vg-33gh-4hwg web
https://nvd.nist.gov/vuln/detail/CVE-2026-3089 advisory
https://github.com/actualbudget/actual/pull/7067 web
https://github.com/actualbudget/actual/commit/18072e1d8b5281db43ded8b21433ee177bae9dfa web
https://fluidattacks.com/advisories/fugue web
https://github.com/actualbudget/actual package