CVE-2026-11420: Path Traversal in Altium Enterprise Server NIS Allows Unauthenticated Arbitrary File Write and File Read

Synopsis

Two path traversal vulnerabilities in the Network Installation Service (NIS) component of Altium Enterprise Server allow an unauthenticated attacker to write arbitrary files to any writable location on the server filesystem and to read package archive files without any credentials. The service is reachable over the network and requires no authentication, session token, or prior access. Successful exploitation enables remote code execution in the context of the service account, as well as disclosure of deployment package contents. A patched-image rebuild at version 8.1.1 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the NIS service over the network; no local access or special network position is required.

• AuthenticationNot required

  No credentials, session token, or account of any privilege level are required to exploit either path traversal vulnerability.

• Victim interactionNot required

  The attacker sends crafted requests directly to the service; no user action or social engineering is needed.

• Attack complexityDetail

  The exploit is reliable and condition-free: no race conditions, specific memory layout, or environmental dependencies are needed (AC:L, AT:N).

Blast Radius

• Reads package archive files stored on the server, disclosing deployment package contents and any credentials or configuration embedded in them.
• Writes arbitrary files to any writable path on the server filesystem, enabling overwrite of application binaries, configuration files, or web-accessible resources.
• Escalates to remote code execution in the context of the NIS service account by dropping attacker-controlled content to a web-accessible directory or replacing a loaded binary.
• Compromises systems and data reachable from the server through the service account's privileges, given the high Subsequent System confidentiality, integrity, and availability impact scores.