Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CVE Vulnerability Details :
CVE-2026-3089
PUBLISHED
More InfoOfficial Page
Assigner-Fluid Attacks
Assigner Org ID-84fe0718-d6bb-4716-a7e8-81a6d1daa869
View Known Exploited Vulnerability (KEV) details
Published At-09 Mar, 2026 | 14:08
Updated At-09 Mar, 2026 | 14:54
Rejected At-
▼CVE Numbering Authority (CNA)
Actual Sync Server 26.2.1 - Authenticated Path Traversal

Actual Sync Server allows authenticated users to upload files through POST /sync/upload-user-file. In versions prior to 26.3.0, improper validation of the user-controlled x-actual-file-id header means that traversal segments (../) can escape the intended directory and write files outside userFiles.This issue affects prior versions of Actual Sync Server 26.3.0.

Affected Products
Vendor
Actual
Product
Actual Sync Server
Collection URL
https://registry.npmjs.org
Package Name
@actual-app/sync-server
Platforms
  • Windows
  • MacOS
  • Linux
Default Status
unaffected
Versions
Affected
  • 26.2.1
Problem Types
TypeCWE IDDescription
CWECWE-22CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Type: CWE
CWE ID: CWE-22
Description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Metrics
VersionBase scoreBase severityVector
4.05.3MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Version: 4.0
Base score: 5.3
Base severity: MEDIUM
Vector:
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Metrics Other Info
Impacts
CAPEC IDDescription
CAPEC-126CAPEC-126 Path Traversal
CAPEC ID: CAPEC-126
Description: CAPEC-126 Path Traversal
Solutions
Configurations
Workarounds
Exploits
Credits
finder
Juan Patarroyo
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://fluidattacks.com/advisories/fugue
third-party-advisory
https://github.com/actualbudget/actual
product
https://github.com/actualbudget/actual/pull/7067
patch
Hyperlink: https://fluidattacks.com/advisories/fugue
Resource:
third-party-advisory
Hyperlink: https://github.com/actualbudget/actual
Resource:
product
Hyperlink: https://github.com/actualbudget/actual/pull/7067
Resource:
patch
▼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://fluidattacks.com/advisories/fugue
exploit
Hyperlink: https://fluidattacks.com/advisories/fugue
Resource:
exploit
Details not found