CVE-2026-11429
Awaiting Analysis Awaiting Analysis - Queue
Path Traversal in Altium Enterprise Server and Altium 365

Publication date: 2026-06-05

Last updated on: 2026-06-09

Assigner: Altium

Description
Two endpoints in the Vault Service ScriptsController, shared by Altium Enterprise Server and Altium 365, accept file uploads where a user-supplied filename component is used to construct the destination path without validation, allowing arbitrary files to be written to any location writable by the service account. Because the file write operation completes before authentication is validated, the vulnerability can be exploited without any credentials, session, or prior knowledge of the system. An unauthenticated network attacker can use this primitive to place executable content in directories where it is later executed by the service, resulting in remote code execution under the Vault Service account. Altium Enterprise Server is fixed in 8.1.1; the issue has been remediated in Altium 365 (commercial and government cloud) at the service level.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-05
Last Modified
2026-06-09
Generated
2026-06-27
AI Q&A
2026-06-06
EPSS Evaluated
2026-06-25
NVD
CVE-2026-11429
EUVD
EUVD-2026-34918
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
altium enterprise_server 8.1.1
altium 365 *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a path traversal issue in the Git Service component used by Altium Enterprise Server and Altium 365. It occurs because the service accepts user-supplied file paths without proper validation during post-clone file-manipulation operations. An authenticated user with basic git access can exploit this to move arbitrary files outside the intended repository area.

By leveraging this file-move capability, an attacker can place malicious script content into directories where the service later executes it, leading to remote code execution under the Git Service account.

In multi-tenant Altium 365 environments, this vulnerability could allow attackers to access data belonging to other tenants on the same infrastructure node.

Impact Analysis

This vulnerability can have severe impacts including unauthorized remote code execution on the Git Service account, which could compromise the affected system.

In multi-tenant deployments, it could lead to unauthorized access to data belonging to other tenants sharing the same infrastructure, potentially resulting in data breaches.

Mitigation Strategies

To mitigate this vulnerability, upgrade Altium Enterprise Server to version 8.1.1 or later, where the issue has been fixed.

For Altium 365, the issue has been remediated at the service level, so ensure your service is up to date.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-11429. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart