CVE-2026-11431: Path Traversal in Altium Projects Service Allows Arbitrary File Read

Synopsis

A path traversal vulnerability exists in the Projects Service download endpoint of Altium Enterprise Server and Altium 365. An authenticated attacker reachable over the network can supply a crafted path parameter to bypass input validation and read arbitrary files from the server filesystem, including configuration files and credential material. Successful exploitation exposes sensitive data that can enable further compromise of connected services. A patched-image rebuild at version 8.1.1 is available on HarborGuard for environments running an affected version of Altium Enterprise Server.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so the attacker must be able to reach the Altium Projects Service over TCP from a remote host.

• AuthenticationRequired

  Any low-privilege authenticated account is sufficient to reach the download endpoint and supply a crafted path parameter.

• Victim interactionNot required

  No victim interaction is needed; the attacker makes direct requests to the endpoint without requiring any other user to take action.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special environmental conditions, race conditions, or timing constraints.

Blast Radius

• Reads arbitrary files from the server filesystem, including service configuration files and stored credential material.
• Exposes credentials that may be shared across multiple connected services, enabling lateral movement or privilege escalation beyond the initial host.
• On multi-tenant Altium 365 deployments, readable configuration could expose credentials shared across tenant boundaries.
• Credential material obtained through this vulnerability can be combined with CVE-2026-11424 to reach cloud-side endpoints and extend the attack surface further.