CVE-2026-11431
HighCVSS 8.3Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
A path traversal vulnerability in the Projects Service download endpoint of Altium Enterprise Server and Altium 365 allows an authenticated user to read arbitrary files (including entire directories as archives) from the server filesystem, potentially exposing configuration and credential data.
Risk Assessment
An attacker can access sensitive configuration files and credentials, leading to further system compromise.
Recommendation
Update Altium Enterprise Server to version 8.1.1; the issue has been remediated in Altium 365 at the service level.
Other vulnerabilities in Altium Enterprise Server
See all- CVE-2026-11429Critical
Two endpoints in the Vault Service ScriptsController, shared by Altium Enterprise Server and Altium 365, accept file uploads where a user-supplied filename is used to construct the destination path without validation, allowing arbitrary file writes. The write occurs before authentication, so no credentials are needed.
- CVE-2026-11423Critical
Path traversal vulnerability in Altium Enterprise Server Collaboration Service allows an authenticated user to read arbitrary files from the server filesystem via a crafted filename in a collaboration message. This can lead to exposure of configuration with passwords and full server compromise.
- CVE-2026-11420Critical
Two path traversal vulnerabilities in the Network Installation Service (NIS) of Altium Enterprise Server allow an unauthenticated network attacker to write arbitrary files to writable locations and read package archive files. No authentication is required.
- CVE-2026-11414Critical
Altium Enterprise Server has a vulnerability related to the use of a hard-coded cryptographic key for signing file download URLs. This key is identical across all installations, allowing unauthenticated attackers to forge signatures and retrieve files from the Vault storage area without authentication.
- CVE-2026-9129Critical
Altium Enterprise Server Viewer has a path traversal vulnerability in the StorageController component. An authenticated user can read arbitrary files from the server filesystem, including the configuration file with database credentials and signing keys.
- CVE-2026-9102Critical
Altium Enterprise Server ComparisonService has a path traversal vulnerability in the Gerber file upload APIs. An authenticated workspace user can supply a crafted filename in the Content-Disposition header to write files outside the intended temporary directory, potentially leading to remote code execution.
- CVE-2026-11424High
SSRF vulnerability in a GraphQL service component shared by Altium Enterprise Server and Altium 365. An authenticated user can submit a request that the server treats as a URL and issues an outbound HTTP GET without validation, returning the response to the attacker.
- CVE-2026-11419High
A path traversal vulnerability in Altium Enterprise Server Vault Service UploadController due to improper validation of a user-controlled path component in image upload requests. An authenticated user can supply a crafted absolute path so that the configured storage root is discarded, allowing arbitrary files to be written to any location on the server filesystem writable by the service account. This can be escalated to remote code execution, service takeover, or denial of service. Altium 365 cloud deployments are not affected.
Original NVD description (English source)
A path traversal vulnerability exists in the Projects Service download endpoint shared by Altium Enterprise Server and Altium 365. An authenticated user can supply a crafted path parameter that bypasses validation, allowing arbitrary files (including entire directories returned as archives) to be read from the server filesystem. Because the readable files include service configuration and credential material, exploitation can be used to gather information enabling further compromise. The issue can be combined with CVE-2026-11424 to reach the cloud-side endpoint. On multi-tenant Altium 365 deployments, the readable configuration could have exposed credentials shared across services. Altium Enterprise Server is fixed in 8.1.1; the issue has been remediated in Altium 365 at the service level.