CVE-2026-3089 Actual Sync Server 26.2.1 - Authenticated Path Traversal
Authenticated attackers can exploit path traversal in the file upload endpoint to write files outside the intended directory.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-3089?
CVE-2026-3089 is a medium-severity path traversal vulnerability in Actual Sync Server, published on 9 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Actual Sync Server allows authenticated users to upload files through POST /sync/upload-user-file. In versions prior to 26.3.0, improper validation of the user-controlled x-actual-file-id header means that traversal segments (../) can escape the intended directory and write files outside userFiles.This issue affects prior versions of Actual Sync Server 26.3.0.
Weakness: CWE-22
Which versions are affected by CVE-2026-3089?
2 open source packages ship an affected version, including @actual-app/sync-server. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@actual-app/sync-server npm | All versions | 26.3.0 |
@actual-app/sync-server npm | All versions | 26.3.0 |
Products include Actualbudget Actual.
How do I fix CVE-2026-3089?
Upgrade @actual-app/sync-server to 26.3.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-3089 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-3089 exists.
Other vulnerabilities in Actual Sync Server
- CVE-2026-27584 ActualBudget server is Missing Authentication for SimpleFIN and Pluggy AI bank sync endpoints
- CVE-2026-33318 Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers
- CVE-2026-27638 ActualBudget missing authorization in sync endpoints allows cross-user budget file access in multi-user mode
Sources
Also known as GHSA-27vg-33gh-4hwg.