CVE-2026-11423

A path traversal vulnerability exists in the Altium Enterprise Server Collaboration Service due to improper handling of user-supplied filenames in the MCAD and Simulation file download flows. A regular authenticated user can submit a collaboration message containing a crafted filename, which is later used to construct the download path on the server without validation, allowing arbitrary files to be read from the server filesystem. Because the readable files include the server's master configuration, which stores credentials for privileged accounts, exploitation can lead to authenticating as a system administrator and gaining full control of the server. Altium 365 cloud deployments are not affected.

CVSS

No CVSS.

References

Link	Resource
https://www.altium.com/platform/security-compliance/security-advisories

Configurations

No configuration.

History

23 Jul 2026, 07:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de salto de ruta existe en el Servicio de Colaboración de Altium Enterprise Server debido al manejo inadecuado de nombres de archivo proporcionados por el usuario en los flujos de descarga de archivos MCAD y de Simulación. Un usuario autenticado regular puede enviar un mensaje de colaboración que contiene un nombre de archivo manipulado, que luego se utiliza para construir la ruta de descarga en el servidor sin validación, permitiendo que se lean archivos arbitrarios del sistema de archivos del servidor. Debido a que los archivos legibles incluyen la configuración maestra del servidor, que almacena credenciales para cuentas privilegiadas, la explotación puede llevar a autenticarse como administrador del sistema y obtener control total del servidor. Las implementaciones en la nube de Altium 365 no se ven afectadas.

05 Jun 2026, 21:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-05 21:16

Updated : 2026-07-23 07:10

NVD link : CVE-2026-11423

Mitre link : CVE-2026-11423

CVE.ORG link : CVE-2026-11423

JSON object : View

Products Affected

No product.

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-269

Improper Privilege Management

{"id": "CVE-2026-11423", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-11423", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-08T13:10:22.677034Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.4, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79", "affectedData": [{"vendor": "Altium", "modules": ["Collaboration Service (MCAD and Simulation download)"], "product": "Altium Enterprise Server", "versions": [{"status": "affected", "version": "0", "lessThan": "8.1.1", "versionType": "semver"}], "platforms": ["Web"], "defaultStatus": "unaffected"}]}], "published": "2026-06-05T21:16:29.353", "references": [{"url": "https://www.altium.com/platform/security-compliance/security-advisories", "source": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79", "description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-269"}]}], "descriptions": [{"lang": "en", "value": "A path traversal vulnerability exists in the Altium Enterprise Server Collaboration Service due to improper handling of user-supplied filenames in the MCAD and Simulation file download flows. A regular authenticated user can submit a collaboration message containing a crafted filename, which is later used to construct the download path on the server without validation, allowing arbitrary files to be read from the server filesystem.\n\n\n\n\nBecause the readable files include the server's master configuration, which stores credentials for privileged accounts, exploitation can lead to authenticating as a system administrator and gaining full control of the server. Altium 365 cloud deployments are not affected."}, {"lang": "es", "value": "Una vulnerabilidad de salto de ruta existe en el Servicio de Colaboraci\u00f3n de Altium Enterprise Server debido al manejo inadecuado de nombres de archivo proporcionados por el usuario en los flujos de descarga de archivos MCAD y de Simulaci\u00f3n. Un usuario autenticado regular puede enviar un mensaje de colaboraci\u00f3n que contiene un nombre de archivo manipulado, que luego se utiliza para construir la ruta de descarga en el servidor sin validaci\u00f3n, permitiendo que se lean archivos arbitrarios del sistema de archivos del servidor.\n\nDebido a que los archivos legibles incluyen la configuraci\u00f3n maestra del servidor, que almacena credenciales para cuentas privilegiadas, la explotaci\u00f3n puede llevar a autenticarse como administrador del sistema y obtener control total del servidor. Las implementaciones en la nube de Altium 365 no se ven afectadas."}], "lastModified": "2026-07-23T07:10:00.113", "sourceIdentifier": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79"}