Path Traversal Vulnerability in Altium Enterprise Server Collaboration Service

CVE-2026-11423

What is CVE-2026-11423?

The Altium Enterprise Server Collaboration Service contains a path traversal vulnerability due to improper handling of filenames provided by users during MCAD and Simulation file downloads. An authenticated user can craft a filename in a collaboration message, which allows them to manipulate the server's download path without proper validation. This can result in unauthorized access to sensitive files on the server filesystem, including critical configuration files that may contain credentials for privileged accounts. If exploited, it can enable attackers to gain system administrator access and potentially compromise the entire server. Notably, Altium 365 cloud deployments remain secure from this vulnerability.

References