Critical 9.4Published May 20, 2026

CVE-2026-9129Path Traversal in Altium Enterprise Server Viewer StorageController Allows Arbitrary File Read

Updated under an hour ago (Oct 26, 2026, 12:10 AM ET)

Does this affect you?

It affects Altium Enterprise Server. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Altium Enterprise Server

Exploited in the last 30 days

A path traversal vulnerability exists in the Altium Enterprise Server Viewer StorageController due to improper handling of file path route parameters. On on-premise deployments that use local filesystem storage, a regular authenticated user can supply a URL-encoded absolute path (such as an encoded drive letter) in a Viewer storage API request, causing the configured storage root to be discarded and allowing arbitrary files to be read from the server filesystem. Because the readable files include the server's master configuration, which stores database credentials, signing key locations, certificate passwords, and OAuth secrets, exploitation can lead to disclosure of all server secrets and full compromise of the server and its data. Cloud deployments are not affected, as they use object storage and do not enable this component.

CVSS: 9.4 CRITICAL (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Weakness (CWE): CWE-22, CWE-200
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Altium
NVD analysis: Deferred
Record last updated: May 20, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Altium Altium Enterprise Server altium:enterprise_server (from the name)	before 8.0.4	CNA record

References

https://www.altium.com/platform/security-compliance/security-advisories

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.