This vulnerability (CVE-2026-9102) affects Altium Enterprise Server's ComparisonService component. Authenticated users can exploit missing filename sanitization in the Gerber file upload APIs by crafting filenames in the multipart Content-Disposition header to escape the temporary upload directory. This path traversal enables writing arbitrary files anywhere on the server filesystem, including web-accessible directories. Consequently, attackers can escalate privileges to remote code execution under the service account or disrupt service by overwriting critical application files.

The vulnerability allows authenticated users to write arbitrary files on the server, potentially leading to remote code execution, service takeover, or denial of service. Because files can be placed in web-accessible directories, attackers can execute malicious code with the privileges of the service account. Overwriting application binaries or configuration files can disrupt normal operation or allow persistent control over the server.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, restrict access to the Altium Enterprise Server to trusted users only and monitor for suspicious file uploads. Avoid exposing the service to untrusted networks. Follow vendor updates closely for any forthcoming patches or mitigations.