Executive brief
Altium Enterprise Server, a platform used for managing electronic design data and collaboration, contains a critical security flaw in its Vault service. Because the system uses a universal, hard-coded security key to sign file download links, any unauthorized person on the network can bypass security checks to download files. When combined with a secondary flaw, an attacker can steal sensitive server configuration files and encryption keys, potentially leading to a total takeover of the server and theft of all stored design data.
Technical details
Altium Enterprise Server contains two critical vulnerabilities in its Vault service download endpoint. First, it utilizes a hard-coded cryptographic key for signing download URLs that is identical across all installations (CWE-798), allowing unauthenticated network attackers to forge valid signatures. Second, the same endpoint is susceptible to a path traversal vulnerability (CWE-22) that allows an attacker to escape the storage root. By chaining these issues, an attacker can read arbitrary files from the server's local filesystem, including sensitive configuration files and master key material. This can lead to full server compromise or bulk data exfiltration when combined with other enumeration flaws like CVE-2026-9152. The issue is resolved in version 8.0.4.
Affected products
- Altium Enterprise Server All versions prior to 8.0.4
Timeline
- 2026-06-05: disclosed
- 2026-06-05: advisory