Two endpoints in the Vault Service ScriptsController of Altium Enterprise Server and Altium 365 improperly handle user-supplied filename components during file uploads, lacking validation to restrict pathname traversal. This allows an unauthenticated network attacker to write arbitrary files anywhere writable by the service account. Because the file write completes before authentication, no credentials or session are required. Attackers can place executable content in directories where the service later executes it, resulting in remote code execution under the Vault Service account. The vulnerability is tracked as CVE-2026-11429 with a CVSS 4.0 score of 10.0 (critical). Altium Enterprise Server versions before 8.1.1 are affected. The vulnerability has been fixed in version 8.1.1 and mitigated in Altium 365 cloud services.

An unauthenticated attacker can exploit this vulnerability to write arbitrary files to any location writable by the Vault Service account. This can lead to remote code execution with the privileges of the Vault Service account, potentially allowing full compromise of the affected system. The vulnerability has a critical severity rating with a CVSS score of 10.0, indicating maximum impact and exploitability without any authentication or user interaction.

A fix is available in Altium Enterprise Server version 8.1.1. Users should upgrade to this version to remediate the vulnerability. For Altium 365 cloud services, the issue has been remediated at the service level by the vendor, so no user action is required for those environments. Patch status for on-premises deployments is confirmed by the vendor advisory.