# CVE-2026-9129: Altium Enterprise Server path traversal in Viewer StorageController

Source: https://junglewise.ai/threats/cve-2026-9129-altium-enterprise-server-path-traversal-in-viewer  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-20. Updated: 2026-05-20  
License: CC BY 4.0 with a link back

CVE-2026-9129 · Severity: info · CVSS 9.4 · Published 2026-05-20

Altium Enterprise Server is a platform used for managing electronic design data and collaboration. A security flaw in the on-premise version allows an authenticated user to bypass folder restrictions and read any file on the server's hard drive. This could lead to the theft of sensitive configuration files, database credentials, and encryption keys, potentially resulting in a total compromise of the server and its data.

## Quick answers

**Is CVE-2026-9129 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9129 being exploited in the wild.

**How severe is CVE-2026-9129?** Informational severity, with a CVSS score of 9.4, published 20 May 2026.

**Which products and versions are affected?** Altium Enterprise Server On-premise deployments using local filesystem storage.

**Is there a fix for CVE-2026-9129?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-9129 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-9129?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability (CWE-22) exists in the StorageController component of Altium Enterprise Server. The flaw is caused by improper handling of file path route parameters, where the application fails to validate URL-encoded absolute paths. An authenticated attacker can provide an encoded drive letter or absolute path in a Viewer storage API request, causing the application to discard the intended storage root and access the entire host filesystem. This allows for the retrieval of the server's master configuration file, which contains high-value secrets such as OAuth tokens, certificate passwords, and database credentials. This issue specifically affects on-premise deployments utilizing local filesystem storage; cloud deployments using object storage are unaffected.

## Affected products

- Altium Enterprise Server On-premise deployments using local filesystem storage

## Timeline

- 2026-05-20: disclosed: CVE-2026-9129 published by Altium

## References

- [https://www.altium.com/platform/security-compliance/security-advisories](https://www.altium.com/platform/security-compliance/security-advisories)