# CVE-2026-11429: Altium Enterprise Server and Altium 365 path traversal in Git Service

Source: https://junglewise.ai/threats/cve-2026-11429-altium-enterprise-server-and-altium-365-path-traversal-in-git  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-05. Updated: 2026-06-05  
License: CC BY 4.0 with a link back

CVE-2026-11429 · Severity: info · CVSS 9.4 · Published 2026-06-05

Altium Enterprise Server and Altium 365 are platforms used for electronic design management and collaboration. A security flaw in their Git Service allows an authorized user to move files to unauthorized locations on the server. This could allow an attacker to take full control of the server, execute malicious code, or access sensitive data belonging to other organizations on shared infrastructure.

Technologies: [Altium 365](https://junglewise.ai/threats/technologies/365). Vendors: [Altium](https://junglewise.ai/threats/vendors/altium).

## Quick answers

**Is CVE-2026-11429 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11429 being exploited in the wild.

**How severe is CVE-2026-11429?** Informational severity, with a CVSS score of 9.4, published 5 June 2026.

**Which products and versions are affected?** Altium 365 All versions prior to June 2026 remediation.

**Is there a fix for CVE-2026-11429?** A patch was published on 2026-06-05: Altium Enterprise Server 8.1.1 released; Altium 365 remediated at service level Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-11429 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-11429?** Check whether you run Altium 365 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability (CWE-22) exists in the Git Service component due to a lack of validation on user-supplied paths during post-clone file-manipulation operations. An authenticated attacker with basic Git access can exploit this 'file-move primitive' to place malicious scripts into executable directories, leading to remote code execution (CWE-94) under the service account. In multi-tenant Altium 365 environments, this flaw could be used to bypass tenant isolation and access data belonging to other customers. Altium Enterprise Server users should upgrade to version 8.1.1, while Altium 365 has been patched at the service level.

## Affected products

- Altium Enterprise Server versions prior to 8.1.1
- Altium 365 All versions prior to June 2026 remediation

## Timeline

- 2026-06-05: advisory: CVE-2026-11429 published by Altium
- 2026-06-05: patched: Altium Enterprise Server 8.1.1 released; Altium 365 remediated at service level

## References

- [https://www.altium.com/platform/security-compliance/security-advisories](https://www.altium.com/platform/security-compliance/security-advisories)

## Related threats

- [Altium Git Service path traversal in CloneRepository action](https://junglewise.ai/threats/cve-2026-14439-altium-git-service-path-traversal-in-clonerepository-action)
- [Altium Enterprise Server and Altium 365 path traversal in Projects Service](https://junglewise.ai/threats/cve-2026-11431-altium-enterprise-server-and-altium-365-path-traversal-in)
- [Altium Enterprise Server and Altium 365 SSRF in GraphQL service](https://junglewise.ai/threats/cve-2026-11424-altium-enterprise-server-and-altium-365-ssrf-in-graphql-service)