The vulnerability (CWE-22) exists in the Git Service component of Altium Enterprise Server and Altium 365, where post-clone file-manipulation operations accept user-supplied paths without proper validation. This allows an authenticated user with basic git access to perform path traversal and move files outside the repository boundary. The attacker can place malicious scripts in directories executed by the service, enabling remote code execution under the Git Service account. On multi-tenant Altium 365 cloud deployments, this could lead to unauthorized access to other tenants' data. The issue is fixed in Altium Enterprise Server version 8.1.1, and Altium 365 cloud services have been remediated by the vendor.

An authenticated user with basic git access can exploit this vulnerability to execute arbitrary code remotely with the privileges of the Git Service account. This can lead to full compromise of the affected service. In multi-tenant cloud environments, it could also allow unauthorized access to data belonging to other tenants sharing the same infrastructure node. The CVSS 4.0 base score is 9.4 (critical), reflecting the high impact on confidentiality, integrity, and availability.

A fix is available in Altium Enterprise Server version 8.1.1. Users should upgrade to this version to remediate the vulnerability. For Altium 365 (commercial and government cloud), the vendor has applied remediation at the service level, so no user action is required for those cloud deployments. Patch status for other versions is not explicitly stated; users should consult the vendor advisory for the latest remediation guidance.