CVE-2026-43872 describes a path traversal vulnerability in the Actualbudget Actual personal finance application. Versions before 26.5.0 have several endpoints vulnerable to CWE-22, which allows attackers with limited privileges to manipulate file pathnames to access restricted directories. The vulnerability is resolved in version 26.5.0. No known exploits are reported in the wild, and no official remediation level or patch links are provided in the advisory.

An attacker with low privileges and no user interaction required can exploit this vulnerability remotely to access files outside intended directories. This could lead to unauthorized information disclosure or other impacts depending on the files accessed. The CVSS 4.0 base score of 5.3 reflects a medium severity impact with network attack vector and low complexity.

Upgrade to Actual version 26.5.0 or later, which fixes the path traversal vulnerability. Since no official patch or remediation level is explicitly stated beyond the version fix, applying this version upgrade is the recommended mitigation. Monitor vendor advisories for any additional guidance.