PT-2026-3140 · Altium · Altium 365

Joris Aerts · Publicado 2026-01-15 · Atualizado 2026-01-16 · CVE-2026-1008

Positive Technologies (AI Summary)

CVSS v3.1

7.6

Alta

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Altium 365 (affected versions not specified)

Description A stored cross-site scripting (XSS) issue exists in the user profile text fields. Insufficient server-side input sanitization allows authenticated users to inject arbitrary HTML and JavaScript payloads using whitespace-based attribute parsing bypass techniques. The injected payload is persisted and executed when other users view the affected profile page, potentially allowing session token theft, phishing attacks, or malicious redirects. Exploitation requires an authenticated account and user interaction to view the crafted profile.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-1008

Produtos afetados

Altium 365

Referências · 4

• https://altium.com/platform/security-compliance/security-advisories · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-1008 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2012303270866468888 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-1008 · Nota de Segurança