CVE-2026-3089CWE-22

Actual Sync Server 26.2.1 - Authenticated Path Traversal

Medium · published March 9, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
39.3
In the wild
Unconfirmed
What it is

Actual Sync Server allows authenticated users to upload files through POST /sync/upload-user-file. In versions prior to 26.3.0, improper validation of the user-controlled x-actual-file-id header means that traversal segments (../) can escape the intended directory and write files outside userFiles.This issue affects prior versions of Actual Sync Server 26.3.0.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00465 · 39.3th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-03-09T14:08Z
EPSS history
Timeline
  • 09 MAR 14:08Z
    Actual Sync Server 26.2.1 - Authenticated Path Traversal
    cvelistv5