Executive brief
Actual Budget, an open-source personal finance application, is affected by a security flaw in how it handles file uploads and server requests. An attacker with basic user access could potentially bypass folder restrictions to manipulate files on the server. This could lead to unauthorized modification of application data or system files, potentially compromising the integrity of the financial tracking service.
Technical details
A path traversal vulnerability (CWE-22) exists in Actual Budget (actual-server) due to improper sanitization of user-supplied input used in file path construction. The flaw is specifically located in file upload sanitization and several other server endpoints. An attacker with low-level authentication (PR:L) can use 'dot-dot-slash' (../) sequences to escape the restricted data directory. This allows for unauthorized file manipulation on the host system. The issue is resolved in version 26.5.0 by improving path sanitization logic.
Affected products
- Actual Budget Actual Budget < 26.5.0
Timeline
- 2026-05-03: patched: Version 26.5.0 released with fixes.
- 2026-05-26: advisory: GitHub Security Advisory GHSA-4wf8-vhhr-4gpv published.
- 2026-06-12: disclosed: CVE-2026-43872 published to NVD.