CVE-2026-14439: Path Traversal in Altium Git Service Allows Remote Code Execution

Synopsis

A path traversal vulnerability in the Git Service component of Altium Enterprise Server and Altium 365 allows an authenticated user with basic git access to move arbitrary files outside the intended repository boundary. The service is reachable over the network and requires no elevated privileges, only a low-privilege git account. Successful exploitation lets an attacker place attacker-controlled script content into executable directories, resulting in remote code execution under the Git Service account; on multi-tenant Altium 365 deployments, this also exposes data belonging to other tenants on the same infrastructure node. A patched-image rebuild at version 8.1.1 is available on HarborGuard for environments running Altium Enterprise Server at an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The Git Service is exposed over the network, so an attacker must be able to reach it via HTTP or HTTPS from a remote host.

• AuthenticationRequired

  Any low-privilege git account is sufficient; no administrative or elevated credentials are needed to trigger the path traversal.

• Victim interactionNot required

  No user interaction is required; the attacker sends crafted post-clone file-manipulation operations directly to the service.

• Attack complexityDetail

  Exploitation is reliable and condition-free: no race conditions, memory layout requirements, or environmental dependencies are involved.

Blast Radius

• Attacker writes arbitrary script content into server-side executable directories and achieves remote code execution running as the Git Service account.
• On multi-tenant Altium 365 nodes, the Git Service account context gives access to repository data and stored credentials belonging to other tenants sharing the same infrastructure node.
• An attacker with code execution under the service account can read, modify, or delete persisted repository contents across all projects hosted by that service instance.
• Full compromise of the Git Service process integrity allows the attacker to tamper with source files, inject backdoors into design artifacts, or disrupt repository availability entirely.