Read the docs
TI-2026-09858 Aliases CVE-2026-11423GHSA-8mjc-gx82-2m9v

Path Traversal in Altium Enterprise Server Collaboration Service Allows Privilege Escalation

Priority MEDIUM 42CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-269.

Summary

A path traversal vulnerability exists in the Altium Enterprise Server Collaboration Service due to improper handling of user-supplied filenames in the MCAD and Simulation file download flows. A regular authenticated user can submit a collaboration message containing a crafted filename, which is later used to construct the download path on the server without validation, allowing arbitrary files to be read from the server filesystem. Because the readable files include the server's master configuration, which stores credentials for privileged accounts, exploitation can lead to authenticating as a system administrator and gaining full control of the server. Altium 365 cloud deployments are not affected.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00321 25th percentileScored 2026-11-07
Fix Fixed Altium Enterprise Server (Altium): 8.1.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AltiumAltium Enterprise Serverbefore 8.1.18.1.1Patch availableCNA
  • Altium Enterprise Server VendorAltium Affected before 8.1.1 Fixed in 8.1.1 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:altium:on-prem_enterprise_server:*:*:*:*:*:*:*:*——Altium
  • cpe:2.3:a:altium:on-prem_enterprise_server:*:*:*:*:*:*:*:* Versions — — ·Altium

Remediation

  • Fix · CNA Altium Enterprise Server (Altium) Fixed in 8.1.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Altium Enterprise Server 8.1.1

    7 records Highest priority Priority MEDIUM 6 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-09862 Path Traversal in Altium Vault ScriptsController Allows Unauthenticated Remote Code ExecutionPriority MEDIUM 51
    • TI-2026-09855 Path Traversal in Altium Enterprise Server NIS Allows Unauthenticated Arbitrary File Write and File ReadPriority MEDIUM 50
    • TI-2026-09854 Path Traversal in Altium Enterprise Server Vault UploadController Allows Arbitrary File WritePriority MEDIUM 49
    Show all 7 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-11423
  2. 2026-10-03 Alias added: GHSA-8mjc-gx82-2m9v

References

Other 1

  • TI-2026-09862 Path Traversal in Altium Vault ScriptsController Allows Unauthenticated Remote Code Execution CVSS 4.0CRITICAL 10.0
  • TI-2026-62547 Server-Side Request Forgery in Altium Enterprise Server UnifiedLogin Service Allows Unauthenticated System Compromise CVSS 4.0CRITICAL 10.0
  • TI-2026-09855 Path Traversal in Altium Enterprise Server NIS Allows Unauthenticated Arbitrary File Write and File Read CVSS 4.0CRITICAL 10.0
  • TI-2026-09854 Path Traversal in Altium Enterprise Server Vault UploadController Allows Arbitrary File Write CVSS 4.0CRITICAL 9.4
  • TI-2026-09851 Path traversal in Altium Enterprise Server CVSS 4.0CRITICAL 10.0
  • TI-2026-08047 Unauthenticated SOAP Endpoint in Altium 365 SearchService Allows Cross-Tenant Data Exfiltration and Index Destruction CVSS 4.0CRITICAL 10.0
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences