CVE-2026-11419
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
A path traversal vulnerability in Altium Enterprise Server Vault Service UploadController due to improper validation of a user-controlled path component in image upload requests. An authenticated user can supply a crafted absolute path so that the configured storage root is discarded, allowing arbitrary files to be written to any location on the server filesystem writable by the service account. This can be escalated to remote code execution, service takeover, or denial of service. Altium 365 cloud deployments are not affected.
Risk Assessment
An attacker could overwrite application or configuration files, potentially leading to full server compromise or service disruption.
Recommendation
Install the security update from Altium for Altium Enterprise Server. If using Altium 365, no action is required.
Other vulnerabilities in Altium Enterprise Server
See all- CVE-2026-11429Critical
Two endpoints in the Vault Service ScriptsController, shared by Altium Enterprise Server and Altium 365, accept file uploads where a user-supplied filename is used to construct the destination path without validation, allowing arbitrary file writes. The write occurs before authentication, so no credentials are needed.
- CVE-2026-11423Critical
Path traversal vulnerability in Altium Enterprise Server Collaboration Service allows an authenticated user to read arbitrary files from the server filesystem via a crafted filename in a collaboration message. This can lead to exposure of configuration with passwords and full server compromise.
- CVE-2026-11420Critical
Two path traversal vulnerabilities in the Network Installation Service (NIS) of Altium Enterprise Server allow an unauthenticated network attacker to write arbitrary files to writable locations and read package archive files. No authentication is required.
- CVE-2026-11414Critical
Altium Enterprise Server has a vulnerability related to the use of a hard-coded cryptographic key for signing file download URLs. This key is identical across all installations, allowing unauthenticated attackers to forge signatures and retrieve files from the Vault storage area without authentication.
- CVE-2026-9129Critical
Altium Enterprise Server Viewer has a path traversal vulnerability in the StorageController component. An authenticated user can read arbitrary files from the server filesystem, including the configuration file with database credentials and signing keys.
- CVE-2026-9102Critical
Altium Enterprise Server ComparisonService has a path traversal vulnerability in the Gerber file upload APIs. An authenticated workspace user can supply a crafted filename in the Content-Disposition header to write files outside the intended temporary directory, potentially leading to remote code execution.
- CVE-2026-11431High
A path traversal vulnerability in the Projects Service download endpoint of Altium Enterprise Server and Altium 365 allows an authenticated user to read arbitrary files (including entire directories as archives) from the server filesystem, potentially exposing configuration and credential data.
- CVE-2026-11424High
SSRF vulnerability in a GraphQL service component shared by Altium Enterprise Server and Altium 365. An authenticated user can submit a request that the server treats as a URL and issues an outbound HTTP GET without validation, returning the response to the attacker.
Original NVD description (English source)
A path traversal vulnerability exists in the Altium Enterprise Server Vault Service UploadController due to improper validation of a user-controlled path component in image upload requests. An authenticated user can supply a crafted absolute path so that the configured storage root is discarded, allowing arbitrary files to be written to any location on the server filesystem writable by the service account. Because content-controlled files can be written to web-accessible directories, or used to overwrite application binaries or configuration files, this can be escalated to remote code execution, service takeover, or denial of service. Altium 365 cloud deployments are not affected, as the affected endpoint is not reachable and the cloud storage architecture mitigates the file-write primitive.