EUVD-2026-31146
GHSA-396j-87wm-36mh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconObtain workspace user credentials
-
DeliverySend multipart Gerber upload to ComparisonService
-
ExploitInject traversal sequence in Content-Disposition filename
-
InstallWrite webshell to web-accessible directory
-
C2Request webshell over HTTP
-
ExecuteExecute commands as service account
-
ImpactPivot or persist via binary/config overwrite
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires (1) network reachability to the Altium Enterprise Server's ComparisonService HTTP API, (2) valid credentials for any regular workspace user account (CVSS PR:L confirms low-privilege authentication is needed - anonymous access is not sufficient), and (3) the server running a version prior to 8.0.4. Exploitation does not require user interaction, MFA bypass, admin rights, or any non-default configuration; the vulnerable Gerber upload path is part of the standard ComparisonService. Escalation to RCE additionally depends on the service account having write access to a directory that is either web-served or contains executed binaries/config - a condition almost always true in default Windows/Linux installations where the service account owns its own install tree. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) plus high impact across confidentiality, integrity, and availability of both the vulnerable and subsequent systems (VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) reflects a low-complexity, low-privilege network attack with cross-scope blast radius - consistent with the score of 9.4. The PR:L requirement (a regular workspace user account) is a meaningful gate in tenants with strict provisioning but trivially satisfied in environments where engineering staff or contractors have routine accounts. EPSS and CISA KEV data were not provided in the intelligence bundle, so probabilistic exploitation likelihood and active exploitation status cannot be confirmed; treat this as a high-priority patch nonetheless because arbitrary file write to a service account combined with web-accessible directories is a well-understood, reliable path to RCE. |
| Exploit ScenarioDerived | An attacker with any low-privilege workspace login authenticates to the Altium Enterprise Server, submits a multipart Gerber upload to the ComparisonService with a Content-Disposition filename like '../../../../inetpub/wwwroot/shell.aspx' (or the platform-equivalent web root), and the service writes the attacker-controlled body to that location. The attacker then requests the planted file via HTTP to obtain code execution as the service account, or alternatively overwrites a service binary or configuration file to achieve persistence or denial of service. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 20, 2026
Arbitrary file write in Altium Enterprise Server ComparisonService allows authenticated workspace users to escape the temporary upload directory and plant files anywhere on the host filesystem via crafted multipart Content-Disposition headers in the Gerber upload APIs. The flaw (CVSS 4.0 score 9.4, CWE-22) escalates to remote code execution by dropping payloads into web-accessible paths or overwriting service binaries, and a vendor patch is available. No public exploit identified at time of analysis.
RemediationAI
Vendor-released patch: Altium Enterprise Server 8.0.4 - upgrade all instances to 8.0.4 or later, consulting the vendor advisory index at https://www.altium.com/platform/security-compliance/security-advisories for release notes and upgrade procedure. If immediate patching is not feasible, restrict ComparisonService and Gerber upload API endpoints at the reverse proxy or WAF to block multipart requests whose Content-Disposition filename contains path separators, '..', or absolute paths (trade-off: legitimate filenames with unusual characters may be rejected), and tighten workspace user provisioning so only vetted accounts can authenticate to the server while you stage the upgrade. Additionally constrain the service account's filesystem permissions to its required directories and audit web-served directories for unexpected files to detect prior exploitation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Altium Enterprise Server is the on-premises collaboration and PLM backend for Altium Designer PCB workflows, exposing REST/multipart APIs for engineering artifacts including Gerber CAM files. The ComparisonService accepts uploaded Gerber files via multipart/form-data, and the filename field of the Content-Disposition header is consumed without canonicalization or sanitization before being joined to the temporary upload directory path. This is a textbook CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) where '../' sequences or absolute paths in the filename traverse outside the intended sandbox, allowing the application - running as the service account - to perform attacker-controlled writes anywhere the process has filesystem permissions, including web roots, scheduled task directories, or binary install paths.
Know when Altium Enterprise Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Primary rating from Vendor (Altium) · only source for this CVE.
CVSS VectorVendor: Altium
Lifecycle Timeline
1DescriptionCVE.org
A path traversal vulnerability exists in the Altium Enterprise Server ComparisonService due to missing filename sanitization in the Gerber file upload APIs. A regular authenticated workspace user can supply a crafted filename in the multipart Content-Disposition header to escape the intended temporary upload directory and write arbitrary files to any location on the server filesystem.
Because content-controlled files can be written to web-accessible directories, this can be escalated to remote code execution in the context of the service account. It can also be used to overwrite application binaries or configuration files, leading to service takeover or denial of service.
Executive ViewAI
Altium Enterprise Server ComparisonService contains a critical file upload vulnerability (CVE-2026-9102, CVSS 9.4) that allows authenticated workspace users to write arbitrary files anywhere on the host system, potentially leading to remote code execution and complete system compromise. This vulnerability threatens the confidentiality, integrity, and availability of critical PCB design infrastructure and could enable attackers to manipulate manufacturing data or steal intellectual property. Organizations using this platform should prioritize immediate patching to prevent potential supply chain attacks.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Altium Enterprise Server
View allRemote code execution in Altium Enterprise Server (versions prior to 8.1.1) and Altium 365 arises from a path traversal
Unauthenticated file disclosure and arbitrary file read in Altium Enterprise Server prior to 8.1.1 allows any network-re
Server-side request forgery in the UnifiedLogin service of on-premises Altium Enterprise Server lets an unauthenticated
Arbitrary file read in Altium Enterprise Server Collaboration Service (versions prior to 8.1.1) allows an authenticated
Arbitrary file read in Altium Enterprise Server on-premise deployments allows any authenticated low-privilege user to es
Server-side request forgery in the shared GraphQL service of Altium Enterprise Server (prior to 8.1.1) and Altium 365 al
Authenticated path traversal in Altium Enterprise Server (before 8.1.1) and Altium 365 lets a low-privileged user read a
Exploit-DB