Vulnerabilities

TI-2026-85547 CVE-2026-123184 · GHSA-2fff-cjw5-9mmr

Authorization flaw in Altium 365 Git Service allows repository writes

LOW 31

An incorrect authorization vulnerability exists in the Altium 365 Git Service.

CVSS 4.0HIGH 7.2 Network Low privileges No interaction EPSS 0.00273 Published 2026-11-05 No fix listed CWE-20

TI-2026-62547 CVE-2026-92808 · GHSA-jpmm-hm5g-c8g4

Server-Side Request Forgery in Altium Enterprise Server UnifiedLogin Service Allows Unauthenticated System Compromise

MEDIUM 50

A server-side request forgery (SSRF) vulnerability exists in the UnifiedLogin service of Altium Enterprise Server.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.00561 Published 2026-09-16 Fixed in 8.1.1 CWE-306

TI-2026-12207 CVE-2026-14439 · GHSA-m97g-7h77-r5pr

Path Traversal in Altium Git Service Allows Remote Code Execution

MEDIUM 44

A path traversal vulnerability exists in the Git Service component shared by Altium Enterprise Server and Altium 365.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.0071 Published 2026-07-01 Fixed in 8.1.1 CWE-22

TI-2026-09864 CVE-2026-11431 · GHSA-96xj-rmhf-c584

Path Traversal in Altium Projects Service Allows Arbitrary File Read

MEDIUM 43

A path traversal vulnerability exists in the Projects Service download endpoint shared by Altium Enterprise Server and Altium 365.

CVSS 4.0HIGH 8.3 Network Low privileges No interaction EPSS 0.00517 Published 2026-06-05 Fixed in 8.1.1 CWE-200

TI-2026-09862 CVE-2026-11429 · GHSA-f7c8-3j67-9q8x

Path Traversal in Altium Vault ScriptsController Allows Unauthenticated Remote Code Execution

MEDIUM 51

Two endpoints in the Vault Service ScriptsController, shared by Altium Enterprise Server and Altium 365, accept file uploads where a user-supplied filename component is used to construct the destination path without vali…

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.01145 Published 2026-06-05 Fixed in 8.1.1 CWE-22

TI-2026-09859 CVE-2026-11424 · GHSA-v97p-56pc-586g

Server-Side Request Forgery in Altium Platform Design GraphQL Service Allows Information Disclosure

LOW 35

A server-side request forgery (SSRF) vulnerability exists in a GraphQL service component shared by Altium Enterprise Server and Altium 365.

CVSS 4.0HIGH 8.3 Network Low privileges No interaction EPSS 0.00226 Published 2026-06-05 Fixed in 8.1.1 CWE-200

TI-2026-09858 CVE-2026-11423 · GHSA-8mjc-gx82-2m9v

Path Traversal in Altium Enterprise Server Collaboration Service Allows Privilege Escalation

MEDIUM 42

A path traversal vulnerability exists in the Altium Enterprise Server Collaboration Service due to improper handling of user-supplied filenames in the MCAD and Simulation file download flows.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.00321 Published 2026-06-05 Fixed in 8.1.1 CWE-22

TI-2026-09855 CVE-2026-11420 · GHSA-q58x-mgvc-jhw9

Path Traversal in Altium Enterprise Server NIS Allows Unauthenticated Arbitrary File Write and File Read

MEDIUM 50

Two path traversal vulnerabilities in the Network Installation Service (NIS) of Altium Enterprise Server allow an unauthenticated network attacker to write arbitrary files to any writable location on the server filesyste…

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.00709 Published 2026-06-05 Fixed in 8.1.1 CWE-22

TI-2026-09854 CVE-2026-11419 · GHSA-6hrc-72jv-9cp2

Path Traversal in Altium Enterprise Server Vault UploadController Allows Arbitrary File Write

MEDIUM 49

A path traversal vulnerability exists in the Altium Enterprise Server Vault Service UploadController due to improper validation of a user-controlled path component in image upload requests.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.00548 Published 2026-06-05 Fixed in 8.1.1 CWE-22

TI-2026-09851 CVE-2026-11414 · GHSA-q7h9-qxg9-hrm3

Path traversal in Altium Enterprise Server

MEDIUM 49

A hard-coded cryptographic key is used by Altium Enterprise Server to sign file download URLs in the Vault service.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.00478 Published 2026-06-05 Fixed in 8.1.1 CWE-22

TI-2026-08047 CVE-2026-9152 · GHSA-g63v-r3mf-m22g

Unauthenticated SOAP Endpoint in Altium 365 SearchService Allows Cross-Tenant Data Exfiltration and Index Destruction

MEDIUM 49

A missing authentication vulnerability exists in the Altium 365 SearchService.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.00339 Published 2026-05-21 No fix listed CWE-306

TI-2026-08026 CVE-2026-9129 · GHSA-3qfq-f4q6-pq76

Path Traversal in Altium Enterprise Server Viewer StorageController Allows Arbitrary File Read

MEDIUM 42

A path traversal vulnerability exists in the Altium Enterprise Server Viewer StorageController due to improper handling of file path route parameters.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.00239 Published 2026-05-20 Fixed in 8.0.4 CWE-200

TI-2026-07999 CVE-2026-9102 · GHSA-396j-87wm-36mh

Path Traversal in Altium Enterprise Server ComparisonService Allows Arbitrary File Write

MEDIUM 43

A path traversal vulnerability exists in the Altium Enterprise Server ComparisonService due to missing filename sanitization in the Gerber file upload APIs.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.00563 Published 2026-05-20 Fixed in 8.0.4 CWE-22

TI-2025-20222 CVE-2025-27380 · GHSA-7q9f-ppr5-2mfg

HTML Injection Leading to Script Execution in Altium Enterprise Server

LOW 33

HTML injection in Project Release in Altium Enterprise Server (AES) 7.0.3 on all platforms allows an authenticated attacker to execute arbitrary JavaScript in the victim’s browser via crafted HTML content.

CVSS 3.1HIGH 7.6 Network Low privileges User interaction EPSS 0.00269 Published 2026-01-22 No fix listed CWE-79

TI-2025-20221 CVE-2025-27379 · GHSA-w5qj-7xqm-q39c

Stored Cross-Site Scripting in AES BOM Viewer

LOW 29

A stored cross-site scripting (XSS) vulnerability in the BOM Viewer in Altium AES 7.0.3 allows an authenticated attacker to inject arbitrary JavaScript into the Description field of a schematic, which is executed when th…

CVSS 3.1MEDIUM 6.8 Network Low privileges User interaction EPSS 0.00228 Published 2026-01-22 No fix listed CWE-79

TI-2025-20220 CVE-2025-27378 · GHSA-m236-84g9-jvrg

SQL Injection in AES Due to Inactive SQL Parsing Configuration

MEDIUM 48

AES contains a SQL injection vulnerability due to an inactive configuration that prevents the latest SQL parsing logic from being applied.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00383 Published 2026-01-22 No fix listed CWE-20

TI-2025-20219 CVE-2025-27377 · GHSA-xfvg-p8x9-f25q

Missing Validation of Self-Signed Certificates in Altium Designer Allows Man-in-the-Middle Attacks

LOW 23

Altium Designer version 24.9.0 does not validate self-signed server certificates for cloud connections.

CVSS 3.1MEDIUM 5.3 Network No auth User interaction EPSS 0.0019 Published 2026-01-22 No fix listed CWE-295

TI-2026-00908 CVE-2026-1181 · GHSA-pfq7-53pj-q6wc

Altium 365 Over-Permissive CORS Configuration Allows Credentialed Cross-Origin Workspace Access

MEDIUM 41

Altium 365 workspace endpoints were configured with an overly permissive Cross-Origin Resource Sharing (CORS) policy that allowed credentialed cross-origin requests from other Altium-controlled subdomains, including foru…

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.0035 Published 2026-01-19 No fix listed CWE-284

TI-2026-00764 CVE-2026-1011 · GHSA-vrmv-j3x6-c7mm

Stored Cross-Site Scripting in Altium Live Support Center Comment Endpoint

LOW 27

A stored cross-site scripting (XSS) vulnerability exists in the Altium Support Center AddComment endpoint due to missing server-side input sanitization.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00285 Published 2026-01-15 No fix listed CWE-116

TI-2026-00763 CVE-2026-1010 · GHSA-7wc5-cm44-jmh9

Stored Cross-Site Scripting in Altium Enterprise Server Workflow Engine Allows Privilege Escalation

LOW 37

A stored cross-site scripting (XSS) vulnerability exists in the Altium Workflow Engine due to missing server-side input sanitization in workflow form submission APIs.

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.00337 Published 2026-01-15 No fix listed CWE-269

TI-2026-00762 CVE-2026-1009 · GHSA-fc5v-qvgj-pv25

Stored Cross-Site Scripting in Altium Live Forum Leading to Cross-Customer Data Exposure

MEDIUM 40

A stored cross-site scripting (XSS) vulnerability exists in the Altium Forum due to missing server-side input sanitization in forum post content.

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.00238 Published 2026-01-15 No fix listed CWE-284

TI-2026-00761 CVE-2026-1008 · GHSA-2vwg-39m6-fw44

Stored Cross-Site Scripting in Altium Live User Profile Fields

LOW 33

A stored cross-site scripting (XSS) vulnerability exists in the user profile text fields of Altium 365.

CVSS 3.1HIGH 7.6 Network Low privileges User interaction EPSS 0.00237 Published 2026-01-15 No fix listed CWE-79

Vulnerabilities

Filters