Vulnerabilidades do Altium Altium Enterprise Server

A server-side request forgery (SSRF) vulnerability exists in the UnifiedLogin service of Altium Enterprise Server. An unauthenticated network attacker can cause the server to issue outbound HTTP requests to a destination of the attacker's choosing, including internal services that are reachable only from the server itself. One such internal service exposes server configuration and credential material without authentication, relying only on the request originating locally. Because the forged requests originate from the server process, that check is satisfied. An unauthenticated attacker can therefore retrieve stored credentials and use them to obtain an administrative session, resulting in full compromise of the server and all of its services. Altium 365 cloud deployments are not affected, as the affected endpoint is disabled in cloud mode.

A path traversal vulnerability exists in the Git Service component shared by Altium Enterprise Server and Altium 365. The service accepts a sequence of post-clone file-manipulation operations that use user-supplied paths without validation, allowing an authenticated user with basic git access to move arbitrary files outside the intended repository area. This file-move primitive can be used to place attacker-controlled script content into directories where it is later executed by the service, resulting in remote code execution under the Git Service account. On multi-tenant Altium 365 deployments, this could have allowed access to data belonging to other tenants on the same infrastructure node. Altium Enterprise Server is fixed in 8.1.1; the issue has been remediated in Altium 365 (commercial and government cloud) at the service level.

Two endpoints in the Vault Service ScriptsController, shared by Altium Enterprise Server and Altium 365, accept file uploads where a user-supplied filename component is used to construct the destination path without validation, allowing arbitrary files to be written to any location writable by the service account. Because the file write operation completes before authentication is validated, the vulnerability can be exploited without any credentials, session, or prior knowledge of the system. An unauthenticated network attacker can use this primitive to place executable content in directories where it is later executed by the service, resulting in remote code execution under the Vault Service account. Altium Enterprise Server is fixed in 8.1.1; the issue has been remediated in Altium 365 (commercial and government cloud) at the service level.

A path traversal vulnerability exists in the Altium Enterprise Server Collaboration Service due to improper handling of user-supplied filenames in the MCAD and Simulation file download flows. A regular authenticated user can submit a collaboration message containing a crafted filename, which is later used to construct the download path on the server without validation, allowing arbitrary files to be read from the server filesystem. Because the readable files include the server's master configuration, which stores credentials for privileged accounts, exploitation can lead to authenticating as a system administrator and gaining full control of the server. Altium 365 cloud deployments are not affected.

Two path traversal vulnerabilities in the Network Installation Service (NIS) of Altium Enterprise Server allow an unauthenticated network attacker to write arbitrary files to any writable location on the server filesystem and to read package archive files from the server. No authentication, session, or credentials are required. Because content-controlled files can be written to web-accessible directories, or used to overwrite application binaries or configuration files, exploitation can be escalated to remote code execution in the context of the service account, and can disclose deployment package contents. Altium 365 cloud deployments are not affected, as the Network Installation Service is not part of the cloud offering.

A hard-coded cryptographic key is used by Altium Enterprise Server to sign file download URLs in the Vault service. Because the key is identical across all installations, an unauthenticated network attacker who can reach the server can forge valid download signatures and retrieve files from the Vault storage area without any authentication, session, or credentials. A separate path traversal vulnerability in the same download endpoint allows the configured storage root to be escaped, enabling reads of arbitrary files on the server filesystem. Combined, these issues allow an unauthenticated attacker to obtain sensitive server configuration and key material, which can lead to full server compromise. The vulnerability can be chained with CVE-2026-9152 to enumerate and bulk-download stored content. Altium 365 cloud deployments are not impacted in practice, as file storage uses object storage rather than the local filesystem.

Existe uma vulnerabilidade de travessia de diretório no StorageController do Altium Enterprise Server Viewer devido ao tratamento inadequado de parâmetros de rota de caminhos de arquivo. Em implantações locais que usam armazenamento em sistema de arquivos local, um usuário autenticado comum pode fornecer um caminho absoluto codificado em URL (como uma letra de unidade codificada) em uma requisição à API de armazenamento do Viewer, fazendo com que a raiz de armazenamento configurada seja descartada e permitindo a leitura de arquivos arbitrários do sistema de arquivos do servidor. Como os arquivos legíveis incluem a configuração mestre do servidor, que armazena credenciais de banco de dados, localizações de chaves de assinatura, senhas de certificados e segredos OAuth, a exploração pode levar à divulgação de todos os segredos do servidor e ao comprometimento total do servidor e de seus dados. Implantações em nuvem não são afetadas, pois usam armazenamento de objetos e não habilitam este componente.

Uma vulnerabilidade de path traversal existe no ComparisonService do Altium Enterprise Server devido à falta de sanitização de nomes de arquivo nas APIs de upload de arquivos Gerber. Um usuário autenticado comum do workspace pode fornecer um nome de arquivo elaborado no cabeçalho Content-Disposition do multipart para escapar do diretório temporário de upload pretendido e gravar arquivos arbitrários em qualquer local do sistema de arquivos do servidor. Como arquivos controlados pelo conteúdo podem ser gravados em diretórios acessíveis via web, isso pode ser escalado para execução remota de código no contexto da conta de serviço. Também pode ser usado para sobrescrever binários da aplicação ou arquivos de configuração, levando à tomada do serviço ou à negação de serviço.