CVE-2026-43872 Overview
Actual is an open-source personal finance application used to track budgets, accounts, and transactions. CVE-2026-43872 is a path traversal vulnerability (CWE-22) affecting several HTTP endpoints in versions prior to 26.5.0. An authenticated attacker can manipulate request paths to access files outside the intended directory scope. The maintainers released version 26.5.0 to remediate the issue.
Critical Impact
Authenticated users can leverage crafted path inputs to read files outside the application's intended directory boundary, exposing data that should remain isolated from the API surface.
Affected Products
- Actual Budget application versions prior to 26.5.0
- Self-hosted Actual server deployments
- Containerized Actual instances built from pre-26.5.0 releases
Discovery Timeline
- 2026-06-12 - CVE-2026-43872 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-43872
Vulnerability Analysis
The vulnerability is classified as Path Traversal under CWE-22. Several endpoints in the Actual server accept user-controlled path components without sufficient normalization. An attacker who can authenticate to the application can submit traversal sequences such as ../ within these parameters. The server resolves the manipulated path relative to its working directory rather than constraining it to the intended subtree. This breaks the file access boundary enforced by the application logic.
Exploitation requires network access and low-privilege authentication, with no user interaction needed. The vulnerability affects file confidentiality but does not provide write or code execution primitives based on the available advisory information.
Root Cause
The root cause is missing canonicalization and boundary validation on file-path arguments accepted by several HTTP endpoints. The affected handlers concatenate user input with a base directory before performing file operations. Without resolving the canonical absolute path and checking it against the allowed base, traversal characters reach the underlying filesystem APIs.
Attack Vector
The attack vector is network-based. An authenticated user issues HTTP requests to vulnerable endpoints with path parameters containing directory traversal sequences. The server then accesses files outside the intended data scope. See the GitHub Security Advisory GHSA-4wf8-vhhr-4gpv for the specific endpoints and parameter names involved.
No verified public exploit code is available at the time of writing. The vulnerability mechanism is described in prose because no validated proof-of-concept was published with the advisory.
Detection Methods for CVE-2026-43872
Indicators of Compromise
- HTTP request logs containing ../ or URL-encoded equivalents such as %2e%2e%2f in path parameters sent to the Actual server
- Access log entries showing file reads outside the expected Actual data directory
- Unexpected 200 responses to requests with abnormal path structures from authenticated sessions
Detection Strategies
- Inspect reverse proxy and application logs for traversal sequences targeting Actual API endpoints
- Correlate authenticated session identifiers with requests containing path manipulation patterns
- Monitor filesystem audit events on the Actual host for reads originating from the application process against paths outside the budget data directory
Monitoring Recommendations
- Enable verbose access logging on the Actual server and any fronting reverse proxy
- Forward web and filesystem telemetry to a centralized log platform for retrospective hunting
- Alert on user accounts performing unusual volumes of file-access endpoint calls within short time windows
How to Mitigate CVE-2026-43872
Immediate Actions Required
- Upgrade all Actual server instances to version 26.5.0 or later without delay
- Review authenticated user accounts and rotate credentials if traversal indicators appear in logs
- Restrict network exposure of the Actual server to trusted users and networks until patching is complete
Patch Information
Version 26.5.0 fixes the issue. Review the ActualBudget release notes for 26.5.0 and the GitHub Security Advisory GHSA-4wf8-vhhr-4gpv for upgrade guidance and the full list of affected endpoints.
Workarounds
- Place the Actual server behind a reverse proxy that rejects requests containing ../ or encoded traversal patterns
- Limit application accounts to the minimum required users and disable unused or shared logins
- Run the Actual process under a dedicated low-privilege user with filesystem access restricted to the budget data directory
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
