CVE-2026-11423: Path Traversal in Altium Enterprise Server Collaboration Service Allows Privilege Escalation

Synopsis

A path traversal vulnerability in the Altium Enterprise Server Collaboration Service allows a regular authenticated user to read arbitrary files from the server filesystem by submitting a crafted filename in a collaboration message used in MCAD or Simulation file download flows. Because the server's master configuration file is readable this way and stores privileged account credentials, an attacker can escalate to full administrator control of the server. A patched-image rebuild at version 8.1.1 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The Collaboration Service must be reachable over the network; an attacker sends the crafted filename payload via a standard network request to the exposed service endpoint.

• AuthenticationRequired

  Any low-privilege authenticated account is sufficient; the attacker does not need elevated or administrative credentials to submit the malicious collaboration message.

• Victim interactionNot required

  No victim action is needed; the attacker interacts directly with the server API without requiring any other user to click a link or open a file.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, memory layout dependencies, or special environmental factors are required to trigger the path traversal.

Blast Radius

• Reads arbitrary files from the server filesystem, including the master configuration file that stores privileged account credentials.
• Uses those credentials to authenticate as a system administrator, gaining full administrative control of the Altium Enterprise Server.
• Modifies server configuration, project data, or collaboration artifacts stored on the instance.
• Disrupts server availability by abusing administrative access to alter or delete critical service files.