EUVD-2026-36548Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible endpoint requires authenticated low-privilege access (PR:L); write-only filesystem impact (I:L) with no confidentiality or availability effect and no scope change.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Actual is an open-source personal finance application. Prior to version 26.5.0, several endpoints are affected by a path traversal vulnerability. Version 26.5.0 fixes the issue.
AnalysisAI
Path traversal across multiple endpoints in Actual, the open-source self-hosted personal finance application, allows authenticated low-privilege users to write files outside intended server directories in all versions prior to 26.5.0. The CVSS 4.0 vector confirms network-accessible exploitation with low-privilege authentication required and impact limited to write operations on the vulnerable system only - no confidentiality or availability impact is indicated. No active exploitation has been confirmed (not in CISA KEV), and the EPSS score of 0.03% (8th percentile) reflects minimal observed exploitation interest at time of analysis.
Technical ContextAI
Actual Budget (CPE: cpe:2.3:a:actualbudget:actual:*:*:*:*:*:*:*:*) is a self-hosted Node.js-based personal finance application maintained by the actualbudget open-source project. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal), a class of flaw where user-supplied path components containing sequences such as '../' are not adequately sanitized or canonicalized before being used in filesystem operations. The advisory notes that several endpoints are affected, indicating the insufficient validation is systemic rather than isolated to a single handler. Because Actual is a self-hosted application, the server's underlying filesystem is the target of the traversal, and the scope of exploitable write operations depends on the filesystem permissions under which the Actual process runs.
RemediationAI
Upgrade Actual Budget to version 26.5.0 or later, which resolves the path traversal vulnerability per the vendor security advisory GHSA-4wf8-vhhr-4gpv (https://github.com/actualbudget/actual/security/advisories/GHSA-4wf8-vhhr-4gpv). If immediate upgrade is not feasible, restrict access to the Actual instance to authenticated, trusted users only - since exploitation requires low-privilege authentication (PR:L), removing public or untrusted user access eliminates the attack surface. Additionally, isolating the Actual server to a private network or behind a VPN prevents unauthenticated network reach and reduces exposure. Note that these compensating controls do not eliminate the underlying flaw; upgrading to 26.5.0 remains the only confirmed remediation. Running the Actual process under a dedicated low-privilege OS account with minimal filesystem permissions can further limit the blast radius of any path traversal write operation.
Actual is a local-first personal finance tool. [CVSS 7.5 HIGH]
Actual personal finance application prior to version 26.2.1 fails to enforce access controls on multi-user sync API endp
Privilege escalation via broken authorization in Actual (self-hosted open-source budgeting app) before 26.7.0 lets any s
Unauthenticated access to the `POST /openid/config` endpoint in Actual Budget sync-server versions <= 26.4.0 exposes the
Actual Sync Server allows authenticated users to upload files through POST /sync/upload-user-file. In versions up to 26.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today