CVE-2026-3089

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Actual Sync Server allows authenticated users to upload files through POST /sync/upload-user-file. In versions prior to 26.3.0, improper validation of the user-controlled x-actual-file-id header means that traversal segments (../) can escape the intended directory and write files outside userFiles.This issue affects prior versions of Actual Sync Server 26.3.0.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
Actual	Actual Sync Server	26.2.1

References

https://fluidattacks.com/advisories/fugueExploit, Third Party Advisory
https://github.com/actualbudget/actualProduct
https://github.com/actualbudget/actual/pull/7067Issue Tracking, Patch
https://fluidattacks.com/advisories/fugueExploit, Third Party Advisory

Timeline

Published: Mar 9, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-308908.0Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the CVE-2026-308916.5Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, a user could access another us CVE-2026-308927.8crun is an open source OCI Container Runtime fully written in C. In versions 1.19 through 1.26, the `crun exec` option `-u` (`--user`) is i CVE-2026-308939.9Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.4.0 to before version 4.14.4, a CVE-2026-308946.1Lack of output escaping leads to a XSS vector in the content history component.CVE-2026-308956.1Lack of output escaping leads to a XSS vector in the readmore links for com_content.CVE-2026-308968.4The installer for Qsee Client versions 1.0.1 and prior insecurely load Dynamic Link Libraries (DLLs). When a user is directed to place some CVE-2026-308976.6A stack-based buffer overflow vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7 CVE-2026-308988.8An example of BashOperator in Airflow documentation suggested a way of passing dag_run.conf in the way that could cause unsanitized user inp CVE-2026-30907.2The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vu CVE-2026-309007.8Improper Check of minimum version in update functionality of certain Zoom Clients for Windows may allow an authenticated user to conduct an CVE-2026-309017.8Improper Input Validation in Zoom Rooms for Windows before 6.6.5 in Kiosk Mode may allow an authenticated user to conduct an escalation of p