Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-43872

actual-server has a path traversal vulnerability

Description

Actual is an open-source personal finance application. Prior to version 26.5.0, several endpoints are affected by a path traversal vulnerability. Version 26.5.0 fixes the issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

actualbudget actual

  • < 26.5.0affected

References