CVE-2026-3089: Authenticated Path Traversal in @actual-app/sync-server
Summary
CVE-2026-3089: Actual Sync Server has an Authenticated Path Traversal. Affects @actual-app/sync-server versions < 26.3.0. Fixed in 26.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @actual-app/sync-server is a file synchronization service that allows users to upload and manage files securely. It is designed to facilitate seamless file sharing and collaboration among users. However, the server has a vulnerability that allows authenticated users to exploit improper validation mechanisms, leading to potential unauthorized file access.
Vulnerability Detail
The vulnerability arises from the improper validation of the user-controlled 'x-actual-file-id' header in versions prior to 26.3.0. This flaw allows authenticated users to use traversal segments ('../') to escape the intended directory, enabling them to write files outside the designated 'userFiles' directory. The ramifications of this vulnerability include unauthorized file access and potential data leakage, which could compromise the integrity and confidentiality of user data.
How To Fix
Minimum fixed version
26.3.0
This is the first release that contains the fix.
npm install @actual-app/sync-server@26.3.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
For users running versions prior to 26.3.0, a temporary workaround is to run the sync server in a filesystem sandbox. This can help limit the file access scope and mitigate the risk of unauthorized file uploads.
Conclusion
The vulnerability CVE-2026-3089 in the @actual-app/sync-server poses a significant risk due to improper validation of file upload headers, allowing for potential unauthorized file access. It is crucial to update to version 26.3.0 or later to mitigate this risk. Users should also consider using filesystem sandboxes as a temporary measure.
See every vulnerability recorded for @actual-app/sync-server →
FAQ
CVE-2026-3089 is a vulnerability in the @actual-app/sync-server that allows authenticated users to exploit path traversal, potentially leading to unauthorized file access.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Versions of @actual-app/sync-server prior to 26.3.0 are affected by this vulnerability.
If you cannot update the package immediately, consider running the sync server in a filesystem sandbox as a temporary workaround.
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for @actual-app/sync-server.
