Quick answers
- Is CVE-2026-11431 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-11431 being exploited in the wild.
- How severe is CVE-2026-11431?
- Informational severity, with a CVSS score of 8.3, published 5 June 2026.
- Which products and versions are affected?
- Altium 365 All versions prior to service-level remediation.
- Is there a fix for CVE-2026-11431?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-11431 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-11431?
- Check whether you run Altium 365 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A path traversal vulnerability (CWE-22) exists in the Projects Service download endpoint shared by Altium Enterprise Server and Altium 365. The flaw is caused by improper validation of path parameters, allowing an authenticated attacker to supply crafted input to access files outside the intended directory. Successful exploitation enables the retrieval of arbitrary files and directories (as archives), including sensitive configuration files and credentials. On multi-tenant Altium 365 deployments, this could expose secrets shared across different services. The issue is fixed in Altium Enterprise Server version 8.1.1 and has been remediated at the service level for Altium 365.
Affected products
- Altium Enterprise Server prior to 8.1.1
- Altium 365 All versions prior to service-level remediation
Timeline
- 2026-06-05: disclosed
- 2026-06-05: advisory