PT-2026-47054 · Altium · Altium Enterprise Server Collaboration Service

Published 2026-06-05 · Updated 2026-06-05 · CVE-2026-11423

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Altium Enterprise Server Collaboration Service (affected versions not specified)

Description A path traversal issue exists due to improper handling of user-supplied filenames within the MCAD and Simulation file download flows. An authenticated user can send a collaboration message with a crafted filename that the server uses to construct a download path without validation, enabling the reading of arbitrary files from the filesystem. Since the server's master configuration containing privileged account credentials can be accessed, this may allow an attacker to authenticate as a system administrator and gain full control of the server. Altium 365 cloud deployments are not affected.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Privilege Management

Path traversal

Weakness Enumeration

CWE-269

CWE-22

Related Identifiers

CVE-2026-11423

Affected Products

Altium Enterprise Server Collaboration Service

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-11423 · Security Note
• https://twitter.com/VulmonFeeds/status/2063045251137233382 · Twitter Post
• https://altium.com/platform/security-compliance/security-advisories · Note