A vulnerability described as critical has been identified in Actual Sync Server up to 26.2.1. This affects an unknown function of the file /sync/upload-user-file. The manipulation results in path traversal.
This vulnerability is known as CVE-2026-3089. It is possible to launch the attack remotely. No exploit is available.
Upgrading the affected component is recommended.
