https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-20T06:59:22.612485+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-274907 EUVD-2026-274907 2026-10-20T06:59:22.614616+00:00 EUVD-2026-274907 https://cve.radiocsirt.org/vuln/fkie_cve-2026-3089 fkie_cve-2026-3089 2026-10-20T06:59:22.614658+00:00

Actual Sync Server allows authenticated users to upload files through POST /sync/upload-user-file. In versions prior to 26.3.0, improper validation of the user-controlled x-actual-file-id header means that traversal segments (../) can escape the intended directory and write files outside userFiles.This issue affects prior versions of Actual Sync Server 26.3.0.

 https://cve.radiocsirt.org/vuln/ghsa-27vg-33gh-4hwg GHSA-27vg-33gh-4hwg — Actual Sync Server has an Authenticated Path Traversal 2026-10-20T06:59:22.614688+00:00

Affected: npm: @actual-app/sync-server

# Description

Actual Sync Server allows authenticated users to upload files through `POST /sync/upload-user-file`. In versions prior to 26.3.0, improper validation of the user-controlled `x-actual-file-id` header means that traversal segments (`../`) can escape the intended directory and write files outside `userFiles`.

## Mitigations The vulnerability can be mitigated in prior versions by running the sync server in a filesystem sandbox.