CVE-2026-9129: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Altium Altium Enterprise Server
CVE-2026-9129 is a critical path traversal vulnerability in the Altium Enterprise Server Viewer StorageController component affecting on-premise deployments using local filesystem storage. An authenticated user can supply a specially crafted URL-encoded absolute file path in a Viewer storage API request, bypassing the configured storage root restriction and reading arbitrary files on the server. This includes sensitive files such as the server's master configuration containing database credentials, signing keys, certificate passwords, and OAuth secrets. Exploitation can lead to full disclosure of server secrets and complete compromise of the server and its data. Cloud deployments are not affected as they use object storage and do not enable this vulnerable component. No official patch or remediation guidance is currently available from the vendor. No known exploits in the wild have been reported.
AI Analysis
Technical Summary
This vulnerability (CVE-2026-9129) arises from improper limitation of pathname to a restricted directory (CWE-22) in the Altium Enterprise Server Viewer StorageController. Specifically, on on-premise installations using local filesystem storage, the component fails to properly validate or restrict file path parameters in API requests. An authenticated user can provide a URL-encoded absolute path that causes the system to ignore the configured storage root, enabling arbitrary file reads on the server filesystem. Critical sensitive files such as the master configuration file, which contains database credentials, signing key locations, certificate passwords, and OAuth secrets, can be accessed. This leads to a high-impact disclosure vulnerability (CWE-200) with potential for full server compromise. Cloud deployments are not vulnerable due to different storage architecture. The CVSS 4.0 base score is 9.4, reflecting critical severity with network attack vector, low attack complexity, no privileges required beyond authentication, and high impact on confidentiality, integrity, and availability. No patch or official remediation level has been published by the vendor as of the current data.
Potential Impact
Successful exploitation allows an authenticated user to read arbitrary files on the server filesystem, including highly sensitive configuration files containing credentials and secrets. This can lead to full disclosure of server secrets and complete compromise of the server and its data. The vulnerability affects only on-premise deployments using local filesystem storage; cloud deployments are not affected. The critical CVSS score of 9.4 indicates a severe impact on confidentiality, integrity, and availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Viewer StorageController API to trusted users only and consider isolating or disabling the vulnerable component if feasible. Monitor vendor communications for updates on patches or official mitigations. Cloud deployments are not affected and require no action related to this vulnerability.
CVE-2026-9129: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Altium Altium Enterprise Server
Description
CVE-2026-9129 is a critical path traversal vulnerability in the Altium Enterprise Server Viewer StorageController component affecting on-premise deployments using local filesystem storage. An authenticated user can supply a specially crafted URL-encoded absolute file path in a Viewer storage API request, bypassing the configured storage root restriction and reading arbitrary files on the server. This includes sensitive files such as the server's master configuration containing database credentials, signing keys, certificate passwords, and OAuth secrets. Exploitation can lead to full disclosure of server secrets and complete compromise of the server and its data. Cloud deployments are not affected as they use object storage and do not enable this vulnerable component. No official patch or remediation guidance is currently available from the vendor. No known exploits in the wild have been reported.
CVSS v4.0
Score 9.4critical
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CVE-2026-9129) arises from improper limitation of pathname to a restricted directory (CWE-22) in the Altium Enterprise Server Viewer StorageController. Specifically, on on-premise installations using local filesystem storage, the component fails to properly validate or restrict file path parameters in API requests. An authenticated user can provide a URL-encoded absolute path that causes the system to ignore the configured storage root, enabling arbitrary file reads on the server filesystem. Critical sensitive files such as the master configuration file, which contains database credentials, signing key locations, certificate passwords, and OAuth secrets, can be accessed. This leads to a high-impact disclosure vulnerability (CWE-200) with potential for full server compromise. Cloud deployments are not vulnerable due to different storage architecture. The CVSS 4.0 base score is 9.4, reflecting critical severity with network attack vector, low attack complexity, no privileges required beyond authentication, and high impact on confidentiality, integrity, and availability. No patch or official remediation level has been published by the vendor as of the current data.
Potential Impact
Successful exploitation allows an authenticated user to read arbitrary files on the server filesystem, including highly sensitive configuration files containing credentials and secrets. This can lead to full disclosure of server secrets and complete compromise of the server and its data. The vulnerability affects only on-premise deployments using local filesystem storage; cloud deployments are not affected. The critical CVSS score of 9.4 indicates a severe impact on confidentiality, integrity, and availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Viewer StorageController API to trusted users only and consider isolating or disabling the vulnerable component if feasible. Monitor vendor communications for updates on patches or official mitigations. Cloud deployments are not affected and require no action related to this vulnerability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Altium
- Date Reserved
- 2026-05-20T17:52:55.487Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a0e0cd6ba1db473629e7a6e
Added to database: 05/20/2026, 19:34:46 UTC
Last enriched: 05/27/2026, 21:03:57 UTC
Last updated: 07/31/2026, 19:23:00 UTC
Views: 81
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.