Description
Actual Sync Server allows authenticated users to upload files through POST /sync/upload-user-file. In versions prior to 26.3.0, improper validation of the user-controlled x-actual-file-id header means that traversal segments (../) can escape the intended directory and write files outside userFiles.This issue affects prior versions of Actual Sync Server 26.3.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Actual | Actual Sync Server | 26.2.1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | @actual-app/sync-server | < 26.3.0 | 26.3.0 | GHSA-27vg-33gh-4hwg |
References
- https://fluidattacks.com/advisories/fugue third-party-advisory
- https://github.com/actualbudget/actual product
- https://github.com/actualbudget/actual/pull/7067 patch