Path Traversal Vulnerability in Altium Enterprise Server's Viewer StorageController

CVE-2026-9129

What is CVE-2026-9129?

A path traversal vulnerability exists in the Altium Enterprise Server Viewer StorageController due to improper handling of file path route parameters. This vulnerability allows authenticated users, on on-premise deployments that utilize local filesystem storage, to manipulate API requests by supplying a URL-encoded absolute path. This manipulation can lead to the configured storage root being disregarded, enabling arbitrary file access from the server's filesystem. The consequence of such exploitation includes the potential disclosure of sensitive information such as the server's master configuration, which contains critical data like database credentials, signing key locations, certificate passwords, and OAuth secrets. Notably, cloud deployments are unaffected, as they operate using object storage and do not employ this vulnerable component.

References