Skip to content
OpenAdvisories

Vendor

Actual

1 known vulnerabilities.

Products

Actual Sync Server 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 5.3
    CVE-2026-3089

    Actual Sync Server 26.2.1 - Authenticated Path Traversal

    Actual Sync Server allows authenticated users to upload files through POST /sync/upload-user-file. In versions prior to 26.3.0, improper validation of the user-controlled x-actual-file-id header means that traversal segments (../) can escape the intended dire…

    Actual Actual Sync Server @actual-app/sync-server npm