HTML Injection Vulnerability in Altium Enterprise Server 7.0.3
CVE-2025-27380

7.6HIGH

Key Information:

Vendor

Altium

Status
Aes
Vendor
CVE Published:
22 January 2026

What is CVE-2025-27380?

An HTML injection vulnerability exists in the Project Release feature of Altium Enterprise Server version 7.0.3 across all platforms. This issue allows authenticated attackers to insert crafted HTML content, which can lead to arbitrary JavaScript execution in the browsers of affected users. Exploitation of this vulnerability could enable attackers to carry out unauthorized actions or access sensitive information, compromising the security of the application and its users.

Affected Version(s)

AES web 7.0.3 <= 7.0.5

References

https://www.altium.com/platform/security-compliance/secur...

CVSS V3.1

Score:
7.6
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.