The Actual application contains a path traversal flaw in several web endpoints that improperly sanitizes file path inputs. An attacker can alter the path segment of a request to reference files outside the intended directory, effectively reading arbitrary files served by the application. The weakness is classified as CWE‑22 and is not documented as requiring authentication, implying the flaw could be exploited by anyone who can reach the vulnerable endpoints.

The vendor is actualbudget, offering the open‑source personal finance application named Actual. Versions prior to 26.5.0 are affected. Versions 26.5.0 and later contain the patch.

The CVSS score of 5.3 indicates medium severity, while the EPSS score of less than 1% suggests a very low likelihood of exploitation at present. The issue is not listed in the CISA KEV catalog. The vulnerability is likely exploitable via exposed HTTP endpoints, representing an external network attack vector. Applying the official update reduces the risk window, as the flaw allows file reads without authentication or privilege escalation.