CVE-2026-11419: Path Traversal in Altium Enterprise Server Vault UploadController Allows Arbitrary File Write

Synopsis

A path traversal vulnerability exists in the Altium Enterprise Server Vault Service UploadController. An authenticated attacker can reach the vulnerable endpoint over the network and supply a crafted absolute path in an image upload request, bypassing the configured storage root and writing arbitrary files to any location on the server filesystem accessible by the service account. Successful exploitation enables remote code execution, service takeover, or denial of service by overwriting application binaries, configuration files, or dropping attacker-controlled content into web-accessible directories. A patched-image rebuild at version 8.1.1 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Vault Service UploadController endpoint over the network; the vulnerable service is network-exposed by design.

• AuthenticationRequired

  Any low-privilege authenticated account is sufficient; no administrative or elevated role is needed to reach the upload endpoint.

• Victim interactionNot required

  No victim interaction is needed; the attacker submits the crafted request directly without requiring another user to take any action.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions, specific memory layout, or environmental factors are required to write the attacker-chosen file.

Blast Radius

• Attacker writes arbitrary files to any filesystem path writable by the service account, including application binary directories and configuration files.
• Overwriting application binaries or startup scripts escalates the file-write primitive to remote code execution and full service takeover.
• Dropping attacker-controlled content into web-accessible directories enables serving of malicious payloads to users of the Enterprise Server web interface.
• Overwriting critical service files or configuration causes the Vault Service to crash or become unavailable, disrupting all connected design workflows.