Vulnerabilities

TI-2026-09864 CVE-2026-11431 · GHSA-96xj-rmhf-c584

Path Traversal in Altium Projects Service Allows Arbitrary File Read

MEDIUM 43

A path traversal vulnerability exists in the Projects Service download endpoint shared by Altium Enterprise Server and Altium 365.

CVSS 4.0HIGH 8.3 Network Low privileges No interaction EPSS 0.00517 Published 2026-06-05 Fixed in 8.1.1 CWE-200

TI-2026-09862 CVE-2026-11429 · GHSA-f7c8-3j67-9q8x

Path Traversal in Altium Vault ScriptsController Allows Unauthenticated Remote Code Execution

MEDIUM 51

Two endpoints in the Vault Service ScriptsController, shared by Altium Enterprise Server and Altium 365, accept file uploads where a user-supplied filename component is used to construct the destination path without vali…

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.01145 Published 2026-06-05 Fixed in 8.1.1 CWE-22

TI-2026-09859 CVE-2026-11424 · GHSA-v97p-56pc-586g

Server-Side Request Forgery in Altium Platform Design GraphQL Service Allows Information Disclosure

LOW 35

A server-side request forgery (SSRF) vulnerability exists in a GraphQL service component shared by Altium Enterprise Server and Altium 365.

CVSS 4.0HIGH 8.3 Network Low privileges No interaction EPSS 0.00226 Published 2026-06-05 Fixed in 8.1.1 CWE-200

TI-2026-09858 CVE-2026-11423 · GHSA-8mjc-gx82-2m9v

Path Traversal in Altium Enterprise Server Collaboration Service Allows Privilege Escalation

MEDIUM 42

A path traversal vulnerability exists in the Altium Enterprise Server Collaboration Service due to improper handling of user-supplied filenames in the MCAD and Simulation file download flows.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.00321 Published 2026-06-05 Fixed in 8.1.1 CWE-22

TI-2026-09855 CVE-2026-11420 · GHSA-q58x-mgvc-jhw9

Path Traversal in Altium Enterprise Server NIS Allows Unauthenticated Arbitrary File Write and File Read

MEDIUM 50

Two path traversal vulnerabilities in the Network Installation Service (NIS) of Altium Enterprise Server allow an unauthenticated network attacker to write arbitrary files to any writable location on the server filesyste…

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.00709 Published 2026-06-05 Fixed in 8.1.1 CWE-22

TI-2026-09854 CVE-2026-11419 · GHSA-6hrc-72jv-9cp2

Path Traversal in Altium Enterprise Server Vault UploadController Allows Arbitrary File Write

MEDIUM 49

A path traversal vulnerability exists in the Altium Enterprise Server Vault Service UploadController due to improper validation of a user-controlled path component in image upload requests.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.00548 Published 2026-06-05 Fixed in 8.1.1 CWE-22

TI-2026-09851 CVE-2026-11414 · GHSA-q7h9-qxg9-hrm3

Path traversal in Altium Enterprise Server