Stored XSS Vulnerability in Altium Forum Affects Altium Products

CVE-2026-1009

What is CVE-2026-1009?

A stored cross-site scripting (XSS) vulnerability has been identified in the Altium Forum, primarily due to insufficient server-side input sanitization in forum post content. This flaw allows an authenticated attacker to inject arbitrary JavaScript into forum posts. When other users view these posts, the injected script executes within the context of their authenticated Altium 365 sessions. This exploitation may lead to unauthorized access to sensitive workspace data, including design files and settings, requiring target users to interact with the malicious content.

References