Path Traversal Vulnerabilities in Altium Enterprise Server Network Installation Service

CVE-2026-11420

What is CVE-2026-11420?

The Network Installation Service (NIS) of Altium Enterprise Server is susceptible to two notable path traversal vulnerabilities. These weaknesses could allow unauthenticated attackers to write arbitrary files to any writable location within the server's filesystem. Additionally, these vulnerabilities could enable the reading of package archive files from the server. If exploited, an attacker could potentially leverage the ability to write files in web-accessible directories, resulting in escalating their access to remote code execution against the service account. Notably, deployments on Altium 365 cloud are safe, as the NIS feature is not included in the cloud offerings.

References