EUVD-2026-34913
GHSA-6hrc-72jv-9cp2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconObtain low-privileged Vault credential
-
DeliveryReach Vault Service UploadController over network
-
ExploitSend image upload with absolute path
-
InstallWrite payload to web root or config
-
C2Trigger execution via HTTP request or restart
-
ExecuteGain code execution as service account
-
ImpactTake over Vault and exfiltrate design data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated session against the Altium Enterprise Server on-premises Vault Service with permission to invoke the UploadController image upload endpoint (CVSS PR:L), reachable over the network with no user interaction and low attack complexity. Exploitation is limited to deployments where the Vault Service runs locally with a writable filesystem and the service account holds write access to a useful target such as the web root, install directory, or configuration files; Altium 365 cloud tenants are out of scope because the endpoint is not reachable and storage is not a writable local filesystem. No special non-default configuration is called out beyond having the Vault Service deployed and accessible to the authenticated attacker. |
| Impact | The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N with high impact across confidentiality, integrity, availability and full subsequent-system impact (SC:H/SI:H/SA:H) drives the 9.4 score, reflecting that any low-privileged authenticated user on the Vault Service can pivot a file-write into code execution or full service takeover with no user interaction. No EPSS score, KEV listing, or POC was supplied, so real-world exploitation pressure is not yet quantified - the risk is currently theoretical-but-severe rather than confirmed actively exploited. The PR:L requirement is the main limiter: realistic risk depends heavily on how broadly Vault accounts are provisioned in the target environment, since in many engineering organizations a large fraction of designers hold authenticated Vault credentials, making the authentication bar effectively low. The tag list mentions 'Hashicorp', which appears inconsistent with the Altium-focused description and CPE-less reference set and should be treated as likely tag noise. |
| Exploit ScenarioDerived | A designer-level Vault user (or attacker who has phished or replayed a single low-privileged Vault credential) authenticates to the Enterprise Server and issues an image upload request whose path field contains an absolute path pointing into the Vault Service web directory, dropping a server-side script or a poisoned configuration file. On the next request to that path - or on the next service restart in the case of a binary or config overwrite - the file executes in the Vault Service's context, yielding remote code execution and full takeover of the design data store. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 05, 2026
Arbitrary file write in the Altium Enterprise Server Vault Service allows authenticated users to escape the configured storage root via the UploadController image upload endpoint and place content-controlled files anywhere the service account can write. The flaw (CVSS 4.0 base 9.4, CWE-22) escalates to remote code execution, service takeover, or denial of service by overwriting application binaries, configuration files, or dropping payloads in web-accessible directories. No public exploit identified at time of analysis, and Altium 365 cloud deployments are explicitly out of scope.
RemediationAI
Patch availability per vendor advisory should be confirmed against the Altium security advisories portal at https://www.altium.com/platform/security-compliance/security-advisories, as no exact fix version is included in the supplied data and no vendor-released patch version is independently confirmed here. Until a verified build is applied, restrict network reachability of the Vault Service UploadController to trusted management networks via firewall or reverse-proxy ACLs, audit and reduce the population of accounts that hold upload privileges (revoking unused or shared Vault credentials), and run the Vault Service under a least-privileged account that lacks write access to the web root, the Altium install directory, and configuration files - accepting the trade-off that overly tight ACLs may break legitimate upload, indexing, or update flows. Where feasible for the organization's workflow, migrating affected on-premises deployments to Altium 365 removes exposure because the vulnerable endpoint is not reachable there.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Vault Service is the on-premises content/document storage backbone of the Altium Enterprise Server (formerly Altium Concord Pro / NEXUS Server), used by PCB and electronics design teams to manage component libraries and design data. The UploadController image handler accepts a user-controlled path fragment that is concatenated with the configured storage root without normalization or boundary enforcement; supplying an absolute path causes standard path-join semantics to discard the prefix, producing a classic CWE-22 (Path Traversal) primitive that resolves to an unconstrained write. Because the write inherits the Vault Service account's filesystem privileges, it reaches anywhere that identity can write - typically the application install directory, IIS or service web roots, and on-disk configuration. Altium 365 SaaS is unaffected because the vulnerable endpoint is not externally reachable and the cloud tier uses object storage rather than a writable local filesystem.
Know when On Prem Enterprise Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Primary rating from Vendor (4760f414-e1ae-4ff1-bdad-c7a9c3538b79) · only source for this CVE.
CVSS VectorVendor: 4760f414-e1ae-4ff1-bdad-c7a9c3538b79
Lifecycle Timeline
1DescriptionCVE.org
A path traversal vulnerability exists in the Altium Enterprise Server Vault Service UploadController due to improper validation of a user-controlled path component in image upload requests. An authenticated user can supply a crafted absolute path so that the configured storage root is discarded, allowing arbitrary files to be written to any location on the server filesystem writable by the service account.
Because content-controlled files can be written to web-accessible directories, or used to overwrite application binaries or configuration files, this can be escalated to remote code execution, service takeover, or denial of service. Altium 365 cloud deployments are not affected, as the affected endpoint is not reachable and the cloud storage architecture mitigates the file-write primitive.
Executive ViewAI
Altium Enterprise Server Vault Service contains a critical arbitrary file write vulnerability (CVE-2026-11419, CVSS 9.4) affecting on-premises deployments. Authenticated users can bypass storage restrictions and write files anywhere the service account can access, enabling remote code execution, application compromise, or denial of service. Organizations operating self-hosted Altium Enterprise installations face immediate risk of unauthorized code execution and complete service takeover.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Network-segment Altium Enterprise Server; restrict UploadController endpoint access via firewall/WAF rules and strict authentication; (2) Run Vault Service with minimal service account privileges, using OS-level controls (filesystem ACLs, AppArmor, SELinux) to deny file writes outside storage directories; (3) Implement path validation at application level, rejecting requests with directory traversal sequences; (4) Enable comprehensive audit logging for all upload operations (user, timestamp, file path, outcome); (5) Monitor filesystem for unexpected file creation in sensitive directories (/bin, /etc, /opt, web directories); (6) Isolate Altium server from production assets and credential stores pending patch release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in On Prem Enterprise Server
View allUnauthenticated arbitrary file write and read in the Network Installation Service (NIS) component of Altium Enterprise S
AES contains a SQL injection vulnerability due to an inactive configuration that prevents the latest SQL parsing logic f
Stored XSS in Altium Workflow Engine allows authenticated users to inject malicious scripts into workflow forms that exe
HTML injection in Project Release in Altium Enterprise Server (AES) 7.0.3 on all platforms allows an authenticated attac
A stored cross-site scripting (XSS) vulnerability in the BOM Viewer in Altium AES 7.0.3 allows an authenticated attacker
Exploit-DB