CVE-2026-11429: Path Traversal in Altium Git Service Allows Remote Code Execution

Synopsis

A path traversal vulnerability exists in the Git Service component of Altium Enterprise Server and Altium 365. An authenticated attacker with basic git access can send crafted post-clone file-manipulation requests that move attacker-controlled content outside the repository boundary and into directories where the service later executes it, resulting in remote code execution under the Git Service account. A patched-image rebuild at Altium Enterprise Server version 8.1.1 is available on HarborGuard for affected environments; Altium 365 has been remediated at the service level by the vendor.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The Git Service is exposed over the network, so an attacker must be able to reach the service endpoint to send the malicious post-clone requests.

• AuthenticationRequired

  A low-privilege account with basic git access is sufficient; no administrative credentials are needed.

• Victim interactionNot required

  The attacker sends crafted requests directly to the service with no action required from another user.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions or special environmental factors are required to trigger the path traversal and achieve code execution.

Blast Radius

• The attacker gains remote code execution under the Git Service account, enabling arbitrary command execution on the host.
• Confidential repository contents, credentials, and other data accessible to the Git Service account are exposed to the attacker.
• The attacker can write, modify, or delete files reachable by the service account, corrupting repository data or planting persistent backdoors.
• On multi-tenant Altium 365 infrastructure nodes, a successful exploit enables access to data belonging to other tenants sharing the same node.