5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-3089

CVE-2026-3089: Actual Sync Server 26.2.1 - Authenticated Path Traversal

Actual Sync Server allows authenticated users to upload files through POST /sync/upload-user-file. In versions prior to 26.3.0, improper validation of the user-controlled x-actual-file-id header means that traversal segments (../) can escape the intended directory and write files outside userFiles.This issue affects prior versions of Actual Sync Server 26.3.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-3089

CVE-2026-3089:

5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@actual-app/sync-server	npm	<= 26.2.0	26.3.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the actual-sync-server where authenticated users can perform a path traversal attack. The root cause is the improper validation of the x-actual-file-id HTTP header in two API endpoints: POST /upload-user-file and GET /download-user-file. The value from this header is used to construct a file path on the server. Without proper sanitization, an attacker can provide a malicious fileId containing ../ sequences to read or write files outside of the intended directory.

The analysis of the patch 18072e1d8b5281db43ded8b21433ee177bae9dfa confirms this. The patch introduces a new function, isValidFileId, which uses a regular expression /^[A-Za-z0-9_-]+$/ to strictly validate the format of the fileId. This validation is then applied at the beginning of the request handlers for both the file upload and download endpoints, effectively closing the path traversal vulnerability. The vulnerable functions are the anonymous Express.js route handlers for these two endpoints, as they are the entry points that process the malicious user-controlled header.

Vulnerable functions

app.post('/upload-user-file')

packages/sync-server/src/app-sync.ts

The anonymous handler for the POST `/upload-user-file` route receives the `x-actual-file-id` header. Before the patch, this `fileId` was used to construct a file path without proper validation, allowing path traversal attacks (`../`). The patch introduces a validation check using `isValidFileId` to ensure the `fileId` only contains allowed characters.

app.get('/download-user-file')

packages/sync-server/src/app-sync.ts

Similar to the upload endpoint, the anonymous handler for the GET `/download-user-file` route also uses the `x-actual-file-id` header to identify a file. The lack of validation for the `fileId` made this endpoint vulnerable to path traversal as well. The patch adds the same `isValidFileId` check to mitigate the vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.