Read the docs
TI-2026-09862 Aliases CVE-2026-11429GHSA-f7c8-3j67-9q8x

Path Traversal in Altium Vault ScriptsController Allows Unauthenticated Remote Code Execution

Priority MEDIUM 51CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

Two endpoints in the Vault Service ScriptsController, shared by Altium Enterprise Server and Altium 365, accept file uploads where a user-supplied filename component is used to construct the destination path without validation, allowing arbitrary files to be written to any location writable by the service account. Because the file write operation completes before authentication is validated, the vulnerability can be exploited without any credentials, session, or prior knowledge of the system. An unauthenticated network attacker can use this primitive to place executable content in directories where it is later executed by the service, resulting in remote code execution under the Vault Service account. Altium Enterprise Server is fixed in 8.1.1; the issue has been remediated in Altium 365 (commercial and government cloud) at the service level.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01145 66th percentileScored 2026-11-07
Fix Fixed Altium Enterprise Server (Altium): 8.1.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AltiumAltium Enterprise Serverbefore 8.1.18.1.1Patch availableCNA
AltiumAltium 365all versions—No fix listedCNA
  • Altium Enterprise Server VendorAltium Affected before 8.1.1 Fixed in 8.1.1 Patch available CNA
  • Altium 365 VendorAltium Affected all versions Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:altium:on-prem_enterprise_server:*:*:*:*:*:*:*:*——Altium
  • cpe:2.3:a:altium:on-prem_enterprise_server:*:*:*:*:*:*:*:* Versions — — ·Altium

Remediation

  • Fix · CNA Altium Enterprise Server (Altium) Fixed in 8.1.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Altium Enterprise Server 8.1.1

    7 records Highest priority Priority MEDIUM 6 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-09855 Path Traversal in Altium Enterprise Server NIS Allows Unauthenticated Arbitrary File Write and File ReadPriority MEDIUM 50
    • TI-2026-09854 Path Traversal in Altium Enterprise Server Vault UploadController Allows Arbitrary File WritePriority MEDIUM 49
    • TI-2026-09851 Path traversal in Altium Enterprise ServerPriority MEDIUM 49
    Show all 7 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-11429
  2. 2026-10-03 Alias added: GHSA-f7c8-3j67-9q8x

References

Other 1

  • TI-2026-62547 Server-Side Request Forgery in Altium Enterprise Server UnifiedLogin Service Allows Unauthenticated System Compromise CVSS 4.0CRITICAL 10.0
  • TI-2026-09855 Path Traversal in Altium Enterprise Server NIS Allows Unauthenticated Arbitrary File Write and File Read CVSS 4.0CRITICAL 10.0
  • TI-2026-09854 Path Traversal in Altium Enterprise Server Vault UploadController Allows Arbitrary File Write CVSS 4.0CRITICAL 9.4
  • TI-2026-09851 Path traversal in Altium Enterprise Server CVSS 4.0CRITICAL 10.0
  • TI-2026-08047 Unauthenticated SOAP Endpoint in Altium 365 SearchService Allows Cross-Tenant Data Exfiltration and Index Destruction CVSS 4.0CRITICAL 10.0
  • TI-2025-20220 SQL Injection in AES Due to Inactive SQL Parsing Configuration CVSS 3.1CRITICAL 9.8
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences