CVE-2026-9102
CriticalCVSS 9.4Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
Altium Enterprise Server ComparisonService has a path traversal vulnerability in the Gerber file upload APIs. An authenticated workspace user can supply a crafted filename in the Content-Disposition header to write files outside the intended temporary directory, potentially leading to remote code execution.
Risk Assessment
An attacker can overwrite application or configuration files, potentially leading to service takeover, denial of service, or remote code execution in the context of the service account.
Recommendation
Upgrade Altium Enterprise Server to a version that includes filename sanitization fixes in the Gerber APIs.
Original NVD description (English source)
A path traversal vulnerability exists in the Altium Enterprise Server ComparisonService due to missing filename sanitization in the Gerber file upload APIs. A regular authenticated workspace user can supply a crafted filename in the multipart Content-Disposition header to escape the intended temporary upload directory and write arbitrary files to any location on the server filesystem. Because content-controlled files can be written to web-accessible directories, this can be escalated to remote code execution in the context of the service account. It can also be used to overwrite application binaries or configuration files, leading to service takeover or denial of service.