What is CVE-2026-3089?

CVE-2026-3089 is a medium-severity vulnerability in Actual Sync Server, classified under Path Traversal. CVSS score: 6.5/10. Published 2026-03-09.

How severe is CVE-2026-3089?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Path Traversal in Actual Sync Server

CVE-2026-3089

Actual Sync Server allows authenticated users to upload files through POST /sync/upload-user-file. In versions prior to 26.3.0, improper validation of the user-controlled x-actual-file-id header means that traversal segments (../) can esca…

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.004 (30.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N.

Affected products

Actual Sync Server — versions 26.2.1
Actualbudget Actual

Weakness classification (CWE)

CWE-22 — Path Traversal

References

help@fluidattacks.com (Exploit, Third Party Advisory, third-party-advisory)
help@fluidattacks.com (Product, product)
help@fluidattacks.com (Patch, patch, Issue Tracking)

Frequently asked questions

What is CVE-2026-3089?: CVE-2026-3089 is a medium-severity vulnerability in Actual Sync Server, classified under Path Traversal. CVSS score: 6.5/10. Published 2026-03-09.
How severe is CVE-2026-3089?: Medium severity. CVSS v3 base score is 6.5 out of 10.