This vulnerability (CVE-2026-9102) affects Altium Enterprise Server's ComparisonService component. The issue is due to improper limitation of a pathname (CWE-22) and insufficient validation of uploaded file names in the Gerber file upload APIs. Authenticated users can supply specially crafted filenames in the multipart Content-Disposition header to traverse directories outside the designated temporary upload folder. This allows writing arbitrary files anywhere on the server filesystem, including web-accessible directories. The impact includes possible remote code execution, service account compromise, and disruption of service through overwriting critical files.

An authenticated workspace user can exploit this vulnerability to write arbitrary files on the server, potentially leading to remote code execution under the service account's privileges. This can result in full service takeover, denial of service, or unauthorized modification of application binaries and configuration files. The CVSS 4.0 base score is 9.4, indicating a critical severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, availability, and scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been published at this time. Until a patch is available, restrict access to the Altium Enterprise Server to trusted users only and monitor for suspicious file uploads. Avoid exposing the service to untrusted networks. Follow vendor communications closely for updates on remediation.