CVE-2026-3089: 
JavaScript vulnerability analysis and mitigation

CVE-2026-3089 is an authenticated path traversal vulnerability in Actual Sync Server (the sync backend for the Actual Budget personal finance application) that allows authenticated users to write files to arbitrary locations outside the intended userFiles directory. The vulnerability affects all versions of @actual-app/sync-server up to and including 26.2.0, with version 26.3.0 introducing the fix. It was published to the GitHub Advisory Database on March 7, 2026, and to the NVD on March 9, 2026. The CVSS v3.1 base score is 6.5 (Medium/High), and the CVSS v4.0 base score is 5.3 (Medium) (Github Advisory, Feedly).

The root cause is improper input validation (CWE-22 — Path Traversal) of the user-controlled x-actual-file-id HTTP request header in the POST /sync/upload-user-file endpoint. Because the server does not sanitize or reject traversal sequences (../) in this header before constructing the file path, an authenticated attacker can supply a value such as ../../../server-files/pwned-traversal to escape the intended userFiles directory and write arbitrary files to other locations on the server's filesystem. The fix introduced a FILE_ID_PATTERN regex (/^[A-Za-z0-9_-]+$/) and an isValidFileId() validation function that rejects any header value containing path traversal characters, returning HTTP 400 with body invalid fileId (Github Advisory, GitHub PR, Fluid Attacks Advisory).

Successful exploitation allows any authenticated user to write attacker-controlled file content to arbitrary locations on the server's filesystem, outside the restricted userFiles directory. This arbitrary file write primitive can potentially be escalated to remote code execution — for example, by overwriting server configuration files, writing web-accessible scripts, or placing malicious files in locations that are subsequently executed by the server process. Confidentiality and availability are not directly impacted by the traversal itself, but integrity of the server's filesystem is fully compromised for any path writable by the sync server process (Github Advisory, Feedly).

A proof-of-concept exploit with concrete HTTP request examples is publicly available via Fluid Attacks, demonstrating a POST to /sync/upload-user-file with the header x-actual-file-id: ../../../server-files/pwned-traversal resulting in file creation at /data/server-files/pwned-traversal.blob (Fluid Attacks Advisory). As of the time of reporting, there is no evidence of active in-the-wild exploitation, and no threat actor attribution has been made. The EPSS score is approximately 0.016–0.018%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA KEV catalog (Github Advisory, Feedly).

1. Obtain authentication credentials: Register or obtain valid credentials for the target Actual Sync Server instance. Authentication is required; the vulnerability is not exploitable anonymously.
2. Authenticate to the sync server: Log in to the Actual Sync Server to obtain a valid session token or cookie required for subsequent API calls.
3. Craft the malicious request: Construct a POST /sync/upload-user-file HTTP request with the x-actual-file-id header set to a path traversal payload, e.g., x-actual-file-id: ../../../server-files/pwned-traversal. Include arbitrary file content in the request body.
4. Send the request: Submit the crafted request to the vulnerable server. The server, lacking input validation, resolves the traversal sequence and writes the uploaded content to the target path (e.g., /data/server-files/pwned-traversal.blob).
5. Escalate if possible: Depending on the server's directory structure and process permissions, attempt to overwrite configuration files, place executable scripts in web-accessible directories, or target other sensitive paths to escalate from arbitrary file write to code execution (Fluid Attacks Advisory, Github Advisory).

• Network: Unusual POST /sync/upload-user-file requests where the x-actual-file-id header contains ../ sequences or values that do not match a standard UUID/alphanumeric file ID format.
• File System: Unexpected .blob files or other files appearing outside the userFiles directory (e.g., in server-files/, application root, or other server directories); files with names containing traversal artifacts.
• Logs: Web server or application access logs showing POST /sync/upload-user-file requests with x-actual-file-id header values containing .., %2e%2e, or other encoded traversal sequences; HTTP 200 responses to such requests on unpatched servers.
• Process: Unexpected file creation events by the Node.js sync server process in directories outside the designated userFiles path, detectable via filesystem auditing tools (e.g., auditd, inotifywait) (Fluid Attacks Advisory, Github Advisory).

Upgrade @actual-app/sync-server to version 26.3.0 or later, which introduces strict validation of the x-actual-file-id header using an allowlist regex pattern that rejects any traversal sequences. As a temporary workaround for instances that cannot be immediately upgraded, the GitHub Advisory recommends running the sync server inside a filesystem sandbox (e.g., Docker with restricted volume mounts, chroot, or similar OS-level isolation) to limit the impact of arbitrary file writes. Additionally, restricting file upload permissions to trusted users only can reduce exposure until patching is completed (Github Advisory, GitHub PR).

The vulnerability was discovered and reported by security researcher js-patarroyo (credited as Finder) via Fluid Attacks, with remediation developed by jfdoming (Github Advisory). The fix was merged into the Actual Budget repository on February 24, 2026, and the advisory was published by maintainer MatissJanis on March 7, 2026. Community discussion has been limited, with no significant media coverage or notable social media reactions identified beyond standard CVE tracking and aggregator posts.