CVE-2026-11424
HighCVSS 8.3Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
SSRF vulnerability in a GraphQL service component shared by Altium Enterprise Server and Altium 365. An authenticated user can submit a request that the server treats as a URL and issues an outbound HTTP GET without validation, returning the response to the attacker.
Risk Assessment
Risk of information disclosure and internal infrastructure reconnaissance, including access to internal endpoints not reachable from the public network.
Recommendation
Update Altium Enterprise Server to version 8.1.1; the issue has been remediated in Altium 365 at the service level.
Other vulnerabilities in Altium Enterprise Server
See all- CVE-2026-11429Critical
Two endpoints in the Vault Service ScriptsController, shared by Altium Enterprise Server and Altium 365, accept file uploads where a user-supplied filename is used to construct the destination path without validation, allowing arbitrary file writes. The write occurs before authentication, so no credentials are needed.
- CVE-2026-11423Critical
Path traversal vulnerability in Altium Enterprise Server Collaboration Service allows an authenticated user to read arbitrary files from the server filesystem via a crafted filename in a collaboration message. This can lead to exposure of configuration with passwords and full server compromise.
- CVE-2026-11420Critical
Two path traversal vulnerabilities in the Network Installation Service (NIS) of Altium Enterprise Server allow an unauthenticated network attacker to write arbitrary files to writable locations and read package archive files. No authentication is required.
- CVE-2026-11414Critical
Altium Enterprise Server has a vulnerability related to the use of a hard-coded cryptographic key for signing file download URLs. This key is identical across all installations, allowing unauthenticated attackers to forge signatures and retrieve files from the Vault storage area without authentication.
- CVE-2026-9129Critical
Altium Enterprise Server Viewer has a path traversal vulnerability in the StorageController component. An authenticated user can read arbitrary files from the server filesystem, including the configuration file with database credentials and signing keys.
- CVE-2026-9102Critical
Altium Enterprise Server ComparisonService has a path traversal vulnerability in the Gerber file upload APIs. An authenticated workspace user can supply a crafted filename in the Content-Disposition header to write files outside the intended temporary directory, potentially leading to remote code execution.
- CVE-2026-11431High
A path traversal vulnerability in the Projects Service download endpoint of Altium Enterprise Server and Altium 365 allows an authenticated user to read arbitrary files (including entire directories as archives) from the server filesystem, potentially exposing configuration and credential data.
- CVE-2026-11419High
A path traversal vulnerability in Altium Enterprise Server Vault Service UploadController due to improper validation of a user-controlled path component in image upload requests. An authenticated user can supply a crafted absolute path so that the configured storage root is discarded, allowing arbitrary files to be written to any location on the server filesystem writable by the service account. This can be escalated to remote code execution, service takeover, or denial of service. Altium 365 cloud deployments are not affected.
Original NVD description (English source)
A server-side request forgery (SSRF) vulnerability exists in a GraphQL service component shared by Altium Enterprise Server and Altium 365. An authenticated user can submit a request whose input is treated as a URL by the server and used to issue an outbound HTTP GET request without URL validation or destination filtering. The response body is then returned to the user. This allows an authenticated attacker to reach internal services and metadata endpoints that would not otherwise be accessible from the public network, and to retrieve their contents. The impact is information disclosure and internal infrastructure reconnaissance; the request primitive is limited to HTTP GET with no custom headers. Altium Enterprise Server is fixed in 8.1.1; the issue has been remediated in Altium 365 at the service level.