CVE-2026-3089Disclosure(actualbudget / actual)

LOWCVSS 6.5 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Actual Sync Server allows authenticated users to upload files through POST /sync/upload-user-file. In versions prior to 26.3.0, improper validation of the user-controlled x-actual-file-id header means that traversal segments (../) can escape the intended directory and write files outside userFiles.This issue affects prior versions of Actual Sync Server 26.3.0.

actualbudget CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Patch / fix

https://github.com/actualbudget/actual/pull/7067

Exploit / PoC references

Other references

https://github.com/actualbudget/actual

Weakness type (CWE)

CWE-22

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

actual

Threat summary

5 mentions across 4 observed days
Momentum state: stable

What's happening

Technical details provided in 2 signals
Disclosure: 3 classified signals
General: 2 classified signals
Peaked 3d ago at 2 mentions (2026-03-09); latest day: 1
5 total mentions across 4 days

Affected systems

Vendors

actualbudget

Products

actual

Deep dive

Activity timeline5 mentions / 4d

Signal classification2 categories

Disclosure

360.0%

General

240.0%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-09	2	Disclosure1General1
2026-03-10	1	Disclosure1
2026-05-05	1	Disclosure1
2026-05-19	1	General1

Full discourse5 posts

Fluid Attacks@fluidattacks155d
Disclosure
A zero-day vulnerability in Actual Sync Server was discovered by an external pentester, then reviewed and documented by Fluid Attacks:ID CVE-2026-3089. You can find the full details here:🔗https://fluidattacks.com/advisories/fugue. We have disclosed 230 #CVE to this date: 🔗https://fluidattacks.com/advisories https://t.co/gC0Uxm7qsR
Post summary
Fluid Attacks has publicly disclosed a zero‑day vulnerability (CVE‑2026‑3089) affecting Actual Sync Server, with detailed information available through their advisory link.
0001074
866 followersView on X
Fluid Attacks@fluidattacks141d
General
A zero-day vulnerability in Actual Sync Server was discovered by an external pentester, then reviewed and documented by Fluid Attacks: ID CVE-2026-3089. You can find the full details here🔗https://fluidattacks.com/advisories/fugue. We have disclosed 235 #CVE to this date 🔗https://fluidattacks.com/advisories. https://t.co/Zhrq5Exxhf
Post summary
The text announces a newly discovered zero‑day CVE‑2026‑3089 in Actual Sync Server, pointing to an advisory for details but providing no further exploit or technical information.
0000068
868 followersView on X
DailyCVE@dailycve212d
Disclosure
🟠 Actual Sync Server, Authenticated Path Traversal, #CVE-2026-3089 (Moderate) https://dailycve.com/actual-sync-server-authenticated-path-traversal-cve-2026-3089-moderate/
Post summary
The linked article announces that CVE‑2026‑3089 is an authenticated path traversal vulnerability in Actual Sync Server with moderate severity.
0000041
167 followersView on X
CVE@CVEnew212d
General
CVE-2026-3089 Actual Sync Server allows authenticated users to upload files through POST /sync/upload-user-file. In versions prior to 26.3.0, improper validation of the user-controll… https://www.cve.org/CVERecord?id=CVE-2026-3089
Post summary
The post briefly notes CVE-2026‑3089 and the nature of the vulnerability, but offers no PoC, exploit, patch, or active use details.
0000084
56.6K followersView on X
CyberDudeBivash® | Global Cybersecurity Company@cyberbivash212d
Disclosure
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-3089 - Actual Sync Server 26.2.1 - Authenticated Path Traversal Intel Report: https://ift.tt/dMBYXq1
Post summary
The post announces a newly identified authenticated path traversal flaw (CVE-2026-3089) in Actual Sync Server 26.2.1, citing an intel report for further details.
0000039
347 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	actualbudget	actual	-	node.js	-

Explore more

Back to dashboard actualbudget CVEs actual vulnerabilities

What researchers are saying

CVE-2026-3089

Fluid Attacks@fluidattacksDisclosure

Fluid Attacks has publicly disclosed a zero‑day vulnerability (CVE‑2026‑3089) affecting Actual Sync Server, with detailed information available through their advisory link.

Fluid Attacks@fluidattacksGeneral

The text announces a newly discovered zero‑day CVE‑2026‑3089 in Actual Sync Server, pointing to an advisory for details but providing no further exploit or technical information.

DailyCVE@dailycveDisclosure

The linked article announces that CVE‑2026‑3089 is an authenticated path traversal vulnerability in Actual Sync Server with moderate severity.

CVE@CVEnewGeneral

The post briefly notes CVE-2026‑3089 and the nature of the vulnerability, but offers no PoC, exploit, patch, or active use details.

CyberDudeBivash® | Global Cybersecurity Company@cyberbivashDisclosure

The post announces a newly identified authenticated path traversal flaw (CVE-2026-3089) in Actual Sync Server 26.2.1, citing an intel report for further details.