Path Traversal Vulnerability in Altium Enterprise Server

CVE-2026-9102

What is CVE-2026-9102?

A path traversal vulnerability exists in Altium Enterprise Server's ComparisonService due to inadequate filename sanitization in its Gerber file upload APIs. An authenticated user can exploit this by manipulating the multipart Content-Disposition header to escape the designated temporary upload directory, allowing unauthorized file writing to any location on the server's filesystem. This vulnerability can potentially enable remote code execution in the context of the service account, leading to various risks such as overwriting application binaries or configuration files, which could facilitate service takeover or denial of service.

References