CVE-2026-3089

Katalog CVE

CVSS 6.5 · Medium EPSS 0,46%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada actualbudget actual. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Actual Sync Server allows authenticated users to upload files through POST /sync/upload-user-file. In versions prior to 26.3.0, improper validation of the user-controlled x-actual-file-id header means that traversal segments (../) can escape the intended directory and write files outside userFiles.This issue affects prior versions of Actual Sync Server 26.3.0.

Rincian

Terbit di NVD

9 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,46% peluang dieksploitasi; lebih tinggi dari 38,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/actualbudget/actual/pull/7067 issue tracking · patch
• https://fluidattacks.com/advisories/fugue exploit · advisory pihak ketiga
• https://github.com/actualbudget/actual product