CVE-2026-43872: Actual Budget path traversal in actual-server endpoints

CVE-2026-43872 · Severity: info · CVSS 5.3 · Published 2026-06-12

Actual Budget, an open-source personal finance application, is affected by a security flaw in how it handles file uploads and server requests. An attacker with basic user access could potentially bypass folder restrictions to manipulate files on the server. This could lead to unauthorized modification of application data or system files, potentially compromising the integrity of the financial tracking service.

Technologies: Actual Budget. Vendors: Actual Budget.

Quick answers

Is CVE-2026-43872 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-43872 being exploited in the wild.
How severe is CVE-2026-43872?
Informational severity, with a CVSS score of 5.3, published 12 June 2026.
Which products and versions are affected?
Actual Budget < 26.5.0.
Is there a fix for CVE-2026-43872?
A patch was published on 2026-05-03: Version 26.5.0 released with fixes. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-43872 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-43872?
Check whether you run Actual Budget at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability (CWE-22) exists in Actual Budget (actual-server) due to improper sanitization of user-supplied input used in file path construction. The flaw is specifically located in file upload sanitization and several other server endpoints. An attacker with low-level authentication (PR:L) can use 'dot-dot-slash' (../) sequences to escape the restricted data directory. This allows for unauthorized file manipulation on the host system. The issue is resolved in version 26.5.0 by improving path sanitization logic.

Affected products

  • Actual Budget Actual Budget < 26.5.0

Timeline

  • 2026-05-03: patched: Version 26.5.0 released with fixes.
  • 2026-05-26: advisory: GitHub Security Advisory GHSA-4wf8-vhhr-4gpv published.
  • 2026-06-12: disclosed: CVE-2026-43872 published to NVD.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.