CVE-2026-14439
Received Received - Intake

Path Traversal in Altium Enterprise Server

Publication date: 2026-07-01

Last updated on: 2026-07-02

Assigner: Altium

Description
A path traversal vulnerability exists in the Git Service component shared by Altium Enterprise Server and Altium 365. The service accepts a sequence of post-clone file-manipulation operations that use user-supplied paths without validation, allowing an authenticated user with basic git access to move arbitrary files outside the intended repository area. This file-move primitive can be used to place attacker-controlled script content into directories where it is later executed by the service, resulting in remote code execution under the Git Service account. On multi-tenant Altium 365 deployments, this could have allowed access to data belonging to other tenants on the same infrastructure node. Altium Enterprise Server is fixed in 8.1.1. The issue has been remediated across Altium 365 shared multi-tenant deployments at the service level; remediation is in progress on remaining Altium 365 deployments.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-01
Last Modified
2026-07-02
Generated
2026-07-02
AI Q&A
2026-07-02
EPSS Evaluated
N/A
NVD
CVE-2026-14439
EUVD
EUVD-2026-41210

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
altium enterprise_server 8.1.1
altium 365 *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Compliance Impact

The vulnerability allows an authenticated user with basic git access to perform path traversal and remote code execution, potentially accessing data belonging to other tenants in multi-tenant deployments. This unauthorized access to data could lead to violations of data protection regulations such as GDPR and HIPAA, which require strict controls on data confidentiality and tenant isolation.

Since the vulnerability enables attackers to move arbitrary files and execute scripts under the Git Service account, it poses a significant risk to the integrity and confidentiality of sensitive data, which are core requirements in compliance standards.

Remediation efforts are underway or completed for affected Altium products, which is critical to restoring compliance with these standards.

Executive Summary

This vulnerability is a path traversal issue in the Git Service component used by Altium Enterprise Server and Altium 365. It occurs because the service accepts user-supplied file paths without proper validation during post-clone file-manipulation operations.

An authenticated user with basic git access can exploit this flaw to move arbitrary files outside the intended repository area.

By doing so, the attacker can place malicious script content into directories where the service later executes them, leading to remote code execution under the Git Service account.

In multi-tenant Altium 365 environments, this could allow attackers to access data belonging to other tenants on the same infrastructure node.

Impact Analysis

This vulnerability can have severe impacts including unauthorized remote code execution on the system running the Git Service.

An attacker with basic git access can move files arbitrarily, potentially compromising the integrity and confidentiality of data.

In multi-tenant deployments, it could lead to cross-tenant data access, exposing sensitive information from other tenants.

Overall, it poses a high risk to system security and data privacy.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Altium Enterprise Server to version 8.1.1 or later, where the issue has been fixed.

For Altium 365 users, the vulnerability has been remediated at the service level in both commercial and government cloud deployments, so ensure your service is up to date.

Additionally, restrict git access to trusted authenticated users only, as the vulnerability requires basic git access with authentication.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14439. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart