PT-2026-47058 · Altium · Altium 365+1

CVE-2026-11431 · Published 2026-06-05 · Updated 2026-06-05

Positive Technologies (AI Summary)

CVSS v4.0

8.3

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Altium Enterprise Server versions prior to 8.1.1 Altium 365 (affected versions not specified)

Description A path traversal issue exists in the Projects Service download endpoint. An authenticated user can provide a crafted path parameter that bypasses validation, enabling the reading of arbitrary files or entire directories returned as archives from the server filesystem. This can lead to the exposure of service configurations and credential material, which may facilitate further compromise. In multi-tenant Altium 365 deployments, this could expose credentials shared across services.

Recommendations Update Altium Enterprise Server to version 8.1.1. For Altium 365, the issue has been remediated at the service level.

Fix

Path traversal

Information Disclosure

Weakness Enumeration

CWE-22

CWE-200

Related Identifiers

CVE-2026-11431

Affected Products

Altium 365

Altium Enterprise Server

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-11431 · Security Note
• https://twitter.com/VulmonFeeds/status/2063029891470139754 · Twitter Post
• https://t.me/cveNotify/166305 · Telegram Post
• https://altium.com/platform/security-compliance/security-advisories · Note
• https://t.me/CVEtracker/56024 · Telegram Post