CVE-2026-9102: Altium Enterprise Server ComparisonService Path Traversal
CVE-2026-9102 is a path traversal flaw in the ComparisonService of Altium Enterprise Server, caused by missing filename sanitization in the Gerber file upload APIs. According to the record, an authenticated workspace user can write files outside the intended temporary upload directory, which could lead to code execution or service disruption. The CNA rates it critical with a CVSS 4.0 score of 9.4, and no confirmed exploitation appears in the sources consulted.
Overview
CVE-2026-9102 affects the ComparisonService of Altium Enterprise Server. The record attributes the flaw to missing filename sanitization in the Gerber file upload APIs, which is classified as CWE-22 (Path Traversal).
Impact
According to the record's description, an authenticated workspace user can use a crafted filename in a multipart upload to write files outside the temporary upload directory.
- Files may be written to arbitrary locations on the server filesystem.
- The description states that content-controlled files placed in web-accessible directories could lead to remote code execution under the service account.
- Overwriting application binaries or configuration files could lead to service takeover or denial of service.
Affected products and versions
The record does not list any affected product versions. The product name is given as Altium Enterprise Server, component ComparisonService. Version ranges must be confirmed with the vendor.
Exploitation status
The CISA KEV catalog does not list this CVE in the record. No confirmed exploitation appears in the sources consulted. The record's EPSS probability is 0.00799 with a percentile of 0.55412.
Remediation and mitigation
- Review the Altium security advisories page for vendor guidance and any updates. The record does not identify a fixed version.
- Restrict which accounts can use the Gerber upload functionality until the vendor's guidance has been reviewed.
- Run the service account with the least privilege needed and limit its write access to application binaries, configuration and web-accessible directories.
- Isolate the server from untrusted networks where operationally feasible.
Detection guidance
- Monitor for files appearing outside the expected temporary upload directory, especially in web-accessible paths.
- Use file integrity monitoring on application binaries and configuration files.
- Review application and web server logs for upload requests from unexpected accounts or with anomalous file handling behaviour.
Limitations of the available information
The record lacks affected versions, fixed versions, patch status and vendor-confirmed exploitation details. The CVSS 4.0 score of 9.4 was supplied by the CNA. The remote code execution and service takeover outcomes are described as possibilities in the record, not as demonstrated results. The record's EPSS date is 2026-10-13.
Frequently asked questions
What is CVE-2026-9102?
It is a path traversal vulnerability in the ComparisonService of Altium Enterprise Server, caused by missing filename sanitization in the Gerber file upload APIs.
Is this vulnerability known to be exploited?
The CVE is not listed in CISA KEV in the record, and no confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.