EUVD-2026-31148
GHSA-3qfq-f4q6-pq76
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconObtain low-privilege account on on-prem server
-
DeliveryAuthenticate to Viewer storage API
-
ExploitSubmit URL-encoded absolute path parameter
-
InstallRead master configuration file
-
C2Extract DB credentials, signing keys, OAuth secrets
-
ExecutePivot to database and sign artifacts
-
ImpactFull server and supply-chain compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires (1) an on-premise Altium Enterprise Server deployment configured with local filesystem storage - cloud/object-storage tenants are not affected and do not load the vulnerable StorageController, and (2) a valid authenticated session as any regular user (CVSS PR:L), with no special role, MFA bypass, or victim interaction needed (UI:N, AT:N). Exploitation is over the network against the Viewer storage API using a URL-encoded absolute path (e.g. encoded drive letter) as the file route parameter; the limiting factors are the on-prem + local-storage deployment mode and possession of any low-privilege account, not configuration changes or platform specifics. |
| Impact | Risk is high and credible: the CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H indicates a network-reachable, low-complexity attack requiring only low privilege and no user interaction, with full impact on both the vulnerable component and downstream systems through stolen secrets. The disclosed configuration file contains DB credentials, signing keys, and OAuth secrets, so a single read primitive cascades into authentication bypass, code signing abuse, and lateral movement - justifying the subsequent (SC/SI/SA:H) scope ratings. No EPSS score, KEV listing, or public POC is in the supplied intelligence, so prioritization rests on CVSS severity, vendor-confirmed reproducibility, and the very low barrier (any regular user account) rather than confirmed in-the-wild abuse. Defenders should treat this as urgent for any internet- or VPN-reachable on-prem instance because every authenticated user is effectively an admin-equivalent threat. |
| Exploit ScenarioDerived | An attacker obtains or registers any regular user account on an on-premise Altium Enterprise Server, authenticates, and issues a Viewer storage API request whose path parameter is a URL-encoded absolute filesystem path pointing at the server's master configuration file. The server discards the configured storage root and returns the file contents, handing the attacker database credentials, OAuth secrets, and signing-key material that are then used to pivot to the database, impersonate the SSO, and sign malicious artifacts - full server and supply-chain compromise from a low-privileged foothold. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 20, 2026
Arbitrary file read in Altium Enterprise Server on-premise deployments allows any authenticated low-privilege user to escape the configured storage root via URL-encoded absolute paths in the Viewer StorageController API, exposing the master configuration containing database credentials, signing keys, certificate passwords, and OAuth secrets. The CVSS 4.0 base score of 9.4 reflects scope change to confidential information enabling full server takeover; no public exploit identified at time of analysis, but the vendor (Altium) has released a fix and cloud-hosted tenants are unaffected because they do not use the local filesystem storage component.
RemediationAI
Upgrade on-premise Altium Enterprise Server to version 8.0.4 or later per the vendor advisory at https://www.altium.com/platform/security-compliance/security-advisories (Vendor-released patch: 8.0.4). Until the upgrade can be staged, restrict network access to the Viewer/Storage API endpoints to trusted administrative networks only, revoke or tightly scope low-privilege user accounts that can authenticate to the server, and consider running the service under a least-privilege OS account whose filesystem read scope excludes the master configuration directory (note: this may break legitimate signing or OAuth flows that need to load those files, so test before enforcing). After patching, rotate all secrets stored in the master configuration - database credentials, code-signing key passphrases, TLS certificate passwords, and OAuth client secrets - because any pre-patch read may have exfiltrated them undetected.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The defect is a classic CWE-22 path traversal in the StorageController route handler, which accepts a file-path route parameter intended to be resolved relative to a configured storage root. Because URL-decoding occurs after the framework's traversal/canonicalization checks (or those checks are absent), an encoded absolute path such as a percent-encoded drive letter (e.g. %43%3a or %2F) is reinterpreted as rooted, discarding the storage prefix and letting the underlying filesystem API open any file the service account can read. The affected CPE cpe:2.3:a:altium:altium_enterprise_server:*:*:*:*:*:*:*:* covers the on-premise product line; cloud deployments back the Viewer with object storage and do not load the vulnerable controller path.
Know when Altium Enterprise Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Primary rating from Vendor (Altium) · only source for this CVE.
CVSS VectorVendor: Altium
Lifecycle Timeline
1DescriptionCVE.org
A path traversal vulnerability exists in the Altium Enterprise Server Viewer StorageController due to improper handling of file path route parameters. On on-premise deployments that use local filesystem storage, a regular authenticated user can supply a URL-encoded absolute path (such as an encoded drive letter) in a Viewer storage API request, causing the configured storage root to be discarded and allowing arbitrary files to be read from the server filesystem.
Because the readable files include the server's master configuration, which stores database credentials, signing key locations, certificate passwords, and OAuth secrets, exploitation can lead to disclosure of all server secrets and full compromise of the server and its data. Cloud deployments are not affected, as they use object storage and do not enable this component.
Executive ViewAI
Altium Enterprise Server on-premise deployments face a critical credential theft vulnerability allowing any authenticated employee to extract database passwords, encryption keys, and OAuth tokens from the master configuration file. Full server compromise is possible with stolen credentials, and the risk extends to downstream systems reliant on those secrets. Cloud-hosted customers are unaffected, but organizations running on-premise instances must apply the available vendor patch immediately.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
More in Altium Enterprise Server
View allRemote code execution in Altium Enterprise Server (versions prior to 8.1.1) and Altium 365 arises from a path traversal
Unauthenticated file disclosure and arbitrary file read in Altium Enterprise Server prior to 8.1.1 allows any network-re
Server-side request forgery in the UnifiedLogin service of on-premises Altium Enterprise Server lets an unauthenticated
Arbitrary file write in Altium Enterprise Server ComparisonService allows authenticated workspace users to escape the te
Arbitrary file read in Altium Enterprise Server Collaboration Service (versions prior to 8.1.1) allows an authenticated
Server-side request forgery in the shared GraphQL service of Altium Enterprise Server (prior to 8.1.1) and Altium 365 al
Authenticated path traversal in Altium Enterprise Server (before 8.1.1) and Altium 365 lets a low-privileged user read a
Exploit-DB