CVE-2026-9129: Altium Enterprise Server Viewer StorageController Path Traversal Enables Arbitrary File Read
A path traversal flaw in the StorageController of the Altium Enterprise Server Viewer lets an authenticated user read arbitrary files on on-premise servers that use local filesystem storage. The record notes that the readable server master configuration holds database credentials, signing key locations and OAuth secrets, so exposure could extend to all server secrets. The record rates the issue critical with a CVSS 4.0 score of 9.4 and shows no confirmed exploitation in the sources consulted.
Overview
CVE-2026-9129 is a path traversal weakness (CWE-22) in the StorageController of the Altium Enterprise Server Viewer. According to the record, improper handling of file path route parameters allows an authenticated user on an on-premise deployment with local filesystem storage to read files outside the configured storage root.
Impact
The record states that readable files include the server master configuration, which stores database credentials, signing key locations, certificate passwords and OAuth secrets. Under this description, a successful read could expose server secrets and enable broader compromise of the server and its data. The record describes cloud deployments as not affected because they use object storage and do not enable this component.
Affected products and versions
- Product listed in the record: Altium Altium Enterprise Server
- Affected range listed in the record: versions below 8.0.4
- Fixed versions: none are listed in the record
The record does not list a fixed version. This does not mean no fix exists. Check the vendor advisory for the fixed build and for confirmation of which deployment types are affected.
Exploitation status
The record shows that this CVE is not listed in the CISA KEV catalog. It also reports an SSVC exploitation value of none and an automatable value of no. No confirmed exploitation appears in the sources consulted, so this analysis does not describe active exploitation.
Remediation and mitigation
- Review the vendor advisory at Altium security advisories and apply the fixed release for the affected Enterprise Server line.
- Prioritize on-premise deployments that use local filesystem storage for the Viewer.
- Restrict filesystem permissions so the service account can read only the directories it needs, and move sensitive configuration out of reachable paths where feasible.
- If compromise is suspected, plan rotation of database credentials, OAuth secrets, certificate passwords and signing material, since the record identifies these as potentially exposed.
Detection guidance
- Review web and application logs for storage API requests with unusual or encoded path parameters that do not match normal Viewer usage.
- Monitor for unexpected read access to server configuration files and secret stores.
- Correlate authentication events for accounts that issue unusual storage requests.
Limitations of the available information
The record provides a single vendor reference and does not list fixed versions, affected build details beyond the version range, or vendor confirmation of exploitation. The EPSS value is recorded as 0.00326 with a percentile of 0.23906, and the SSVC technical impact is total. The record's source status is Deferred, so details may change as the vendor and NVD update the entry.
Frequently asked questions
Which Altium Enterprise Server versions are affected by CVE-2026-9129?
The record lists the affected range as versions below 8.0.4 for Altium Enterprise Server. No fixed version is listed, so check the vendor advisory for the corrected build.
Is CVE-2026-9129 being actively exploited?
The record shows the CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted. The record does not claim active exploitation.
Are cloud deployments affected?
The record states that cloud deployments are not affected because they use object storage and do not enable this component. Only on-premise deployments that use local filesystem storage are described as affected.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.