CVE-2026-11423 is a path traversal vulnerability in Altium Enterprise Server's Collaboration Service. The issue arises from improper handling of user-supplied filenames in the MCAD and Simulation file download flows. Authenticated users can submit crafted filenames in collaboration messages, which are used without validation to build server download paths. This allows reading arbitrary files on the server filesystem, including the master configuration file that stores credentials for privileged accounts. Successful exploitation can enable an attacker to authenticate as a system administrator and gain full control of the server. Altium 365 cloud deployments are not affected by this vulnerability. No vendor advisory or patch information is currently available.

An authenticated user can read arbitrary files on the server, including sensitive configuration files containing credentials for privileged accounts. This can lead to privilege escalation to system administrator level and full server compromise. The vulnerability is rated critical with a CVSS 4.0 score of 9.4, indicating high attack vector and impact metrics. Cloud deployments of Altium 365 are not impacted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user permissions and monitor for suspicious activity related to file downloads in the Collaboration Service. Avoid exposing the affected service to untrusted users.