PT-2026-24064 · Actual · Actual Sync Server

Juan Patarroyo · Published 2026-03-09 · Updated 2026-05-19 · CVE-2026-3089

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Actual Sync Server versions prior to 26.3.0

Description Actual Sync Server allows authenticated users to upload files through the ''/sync/upload-user-file'' API endpoint. In versions prior to 26.3.0, insufficient validation of the x-actual-file-id header allows traversal segments (../) to escape the intended directory, potentially enabling writing files outside the userFiles directory.

Recommendations Update to version 26.3.0 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-3089

GHSA-27VG-33GH-4HWG

Affected Products

Actual Sync Server

References · 14

• 🔥 https://fluidattacks.com/advisories/fugue · Exploit
• https://github.com/actualbudget/actual/pull/7067 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-3089 · Security Note
• https://osv.dev/vulnerability/GHSA-27vg-33gh-4hwg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-3089 · Vendor Advisory
• https://github.com/actualbudget/actual · Note
• https://github.com/actualbudget/actual/commit/18072e1d8b5281db43ded8b21433ee177bae9dfa · Note
• https://github.com/actualbudget/actual/security/advisories/GHSA-27vg-33gh-4hwg · Note
• https://twitter.com/cyberbivash/status/2031058080474051018 · Twitter Post
• https://twitter.com/dailycve/status/2031216962714337617 · Twitter Post
• https://twitter.com/fluidattacks/status/2056849123865919675 · Twitter Post
• https://t.me/CVEtracker/46907 · Telegram Post
• https://twitter.com/CVEnew/status/2031122529893470224 · Twitter Post
• https://twitter.com/fluidattacks/status/2051772170561278147 · Twitter Post