Mitigation Strategies

To mitigate this path traversal vulnerability in the Actual Budget application, you should upgrade the 'actual' npm package to version 26.5.0 or later, as this version contains the fix.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-43872 is a path traversal vulnerability found in the Actual Budget application, specifically in the actual-server component. This vulnerability affects versions up to and including 26.4.0. It occurs because several endpoints improperly handle user input, allowing an attacker to manipulate pathnames to access files and directories outside of the intended restricted areas.

This issue is classified as a medium severity vulnerability and is related to CWE-22, which is the improper limitation of a pathname to a restricted directory. The vulnerability was fixed in version 26.5.0 of the application.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to access files and directories outside the intended restricted areas of the Actual Budget application server. By exploiting this path traversal flaw, an attacker might read sensitive files or data that should be protected, potentially leading to unauthorized information disclosure.

Since the vulnerability does not require user interaction and can be exploited remotely, it increases the risk of exposure of sensitive personal finance data managed by the application.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify how the path traversal vulnerability in the Actual Budget application impacts compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves path traversal in several endpoints of the Actual Budget application versions up to 26.4.0. Detection typically involves testing these endpoints for improper handling of pathname inputs that allow traversal outside restricted directories.

A common approach is to send crafted HTTP requests to the affected endpoints with path traversal payloads such as "../" sequences to see if the server returns files or directories outside the intended scope.

Example commands using curl to test for path traversal might include:

• curl -v "http://<target>/endpoint?file=../../../../etc/passwd"
• curl -v "http://<target>/endpoint?path=../secret/config.json"

Replace <target> and endpoint with the actual server address and vulnerable endpoint paths. Successful retrieval of files outside the intended directory indicates the presence of the vulnerability.

Useful 0 Not Useful 0