Most recent entries from all

EUVD-2026-274907

fkie_cve-2026-3089

Actual Sync Server allows authenticated users to upload files through POST /sync/upload-user-file. In versions prior to 26.3.0, improper validation of the user-controlled x-actual-file-id header means that traversal segments (../) can escape the intended directory and write files outside userFiles.This issue affects prior versions of Actual Sync Server 26.3.0.

GHSA-27vg-33gh-4hwg — Actual Sync Server has an Authenticated Path Traversal

Affected: npm: @actual-app/sync-server

# Description

Actual Sync Server allows authenticated users to upload files through `POST /sync/upload-user-file`. In versions prior to 26.3.0, improper validation of the user-controlled `x-actual-file-id` header means that traversal segments (`../`) can escape the intended directory and write files outside `userFiles`.

## Mitigations The vulnerability can be mitigated in prior versions by running the sync server in a filesystem sandbox.