CVE-2026-14439

Deferred Deferred - Pending Action

Path Traversal in Altium Enterprise Server

Publication date: 2026-07-01

Last updated on: 2026-07-20

Assigner: Altium

Description

A path traversal vulnerability exists in the Git Service component shared by Altium Enterprise Server and Altium 365. The service accepts a sequence of post-clone file-manipulation operations that use user-supplied paths without validation, allowing an authenticated user with basic git access to move arbitrary files outside the intended repository area. This file-move primitive can be used to place attacker-controlled script content into directories where it is later executed by the service, resulting in remote code execution under the Git Service account. On multi-tenant Altium 365 deployments, this could have allowed access to data belonging to other tenants on the same infrastructure node. Altium Enterprise Server is fixed in 8.1.1; the issue has been remediated in Altium 365 (commercial and government cloud) at the service level.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-01

Last Modified

2026-07-20

Generated

2026-07-22

AI Q&A

2026-07-02

EPSS Evaluated

2026-07-20

NVD

CVE-2026-14439

EUVD

EUVD-2026-41210

Affected Vendors & Products

Vendor	Product	Version / Range
altium	enterprise_server	8.1.1
altium	365	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability is a path traversal issue in the Git Service component used by Altium Enterprise Server and Altium 365. It occurs because the service accepts user-supplied file paths without proper validation during post-clone file-manipulation operations.

An authenticated user with basic git access can exploit this flaw to move arbitrary files outside the intended repository area.

By doing so, the attacker can place malicious script content into directories where the service later executes them, leading to remote code execution under the Git Service account.

In multi-tenant Altium 365 environments, this could allow attackers to access data belonging to other tenants on the same infrastructure node.

Impact Analysis

This vulnerability can have severe impacts including unauthorized remote code execution on the system running the Git Service.

An attacker with basic git access can move files arbitrarily, potentially compromising the integrity and confidentiality of data.

In multi-tenant deployments, it could lead to cross-tenant data access, exposing sensitive information from other tenants.

Overall, it poses a high risk to system security and data privacy.

Compliance Impact

The vulnerability allows an authenticated user with basic git access to perform path traversal and remote code execution, potentially accessing data belonging to other tenants in multi-tenant deployments. This unauthorized access to data could lead to violations of data protection regulations such as GDPR and HIPAA, which require strict controls on data confidentiality and tenant isolation.

Since the vulnerability enables attackers to move arbitrary files and execute scripts under the Git Service account, it poses a significant risk to the integrity and confidentiality of sensitive data, which are core requirements in compliance standards.

Remediation efforts are underway or completed for affected Altium products, which is critical to restoring compliance with these standards.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Altium Enterprise Server to version 8.1.1 or later, where the issue has been fixed.

For Altium 365 users, the vulnerability has been remediated at the service level in both commercial and government cloud deployments, so ensure your service is up to date.

Additionally, restrict git access to trusted authenticated users only, as the vulnerability requires basic git access with authentication.

Hi! I’m here to help you understand CVE-2026-14439. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70