This vulnerability involves two path traversal flaws in the Network Installation Service component of Altium Enterprise Server. An unauthenticated network attacker can exploit these flaws to write arbitrary files to any writable location on the server filesystem and read package archive files. Because files can be written to web-accessible directories or overwrite critical application binaries or configuration files, an attacker can escalate this to remote code execution under the service account context. The vulnerability is rated with a CVSS 4.0 base score of 10.0 (critical). Altium 365 cloud deployments are not affected as they do not include the vulnerable service.

Successful exploitation allows unauthenticated attackers to write arbitrary files and read sensitive package archives on the server. This can lead to disclosure of deployment package contents and remote code execution with the privileges of the service account running the Network Installation Service. This poses a critical risk to confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently documented, organizations should monitor Altium's advisories for updates. In the meantime, restricting network access to the Network Installation Service and isolating the server may reduce exposure. Note that Altium 365 cloud deployments are not affected.