{"id":"CVE-2026-11429","state":"PUBLISHED","title":"Path Traversal in Altium Vault ScriptsController Allows Unauthenticated Remote Code Execution","description":"Two endpoints in the Vault Service ScriptsController, shared by Altium Enterprise Server and Altium 365, accept file uploads where a user-supplied filename component is used to construct the destination path without validation, allowing arbitrary files to be written to any location writable by the service account. Because the file write operation completes before authentication is validated, the vulnerability can be exploited without any credentials, session, or prior knowledge of the system.\n\n\n\n\nAn unauthenticated network attacker can use this primitive to place executable content in directories where it is later executed by the service, resulting in remote code execution under the Vault Service account. Altium Enterprise Server is fixed in 8.1.1; the issue has been remediated in Altium 365 (commercial and government cloud) at the service level.","publishedAt":"2026-06-05T21:01:37.963Z","updatedAt":"2026-06-09T16:06:03.926Z","severity":{"score":10,"label":"Critical","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","source":"Altium"},"assigner":"Altium","products":["Altium Altium Enterprise Server","Altium Altium 365"],"affected":[{"vendor":"Altium","product":"Altium Enterprise Server","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"8.1.1","versionType":"semver"}],"platforms":["Web"],"modules":["Vault Service (ScriptsController)"]},{"vendor":"Altium","product":"Altium 365","defaultStatus":"affected","versions":[{"version":"unspecified","status":"affected"}],"platforms":["Web"],"modules":["Vault Service (ScriptsController)"]}],"references":["https://www.altium.com/platform/security-compliance/security-advisories"],"weaknesses":["CWE-22","CWE-306"],"ingestedAt":"2026-10-29T20:10:52.580Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/11xxx/CVE-2026-11429.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-11429","state":"PUBLISHED","datePublished":"2026-06-05T21:01:37.963Z","dateUpdated":"2026-06-09T16:06:03.926Z","assignerShortName":"Altium","assignerOrgId":"4760f414-e1ae-4ff1-bdad-c7a9c3538b79","dateReserved":"2026-06-05T20:52:55.972Z"},"containers":{"cna":{"title":"Path Traversal in Altium Vault ScriptsController Allows Unauthenticated Remote Code Execution","descriptions":[{"lang":"en","value":"Two endpoints in the Vault Service ScriptsController, shared by Altium Enterprise Server and Altium 365, accept file uploads where a user-supplied filename component is used to construct the destination path without validation, allowing arbitrary files to be written to any location writable by the service account. Because the file write operation completes before authentication is validated, the vulnerability can be exploited without any credentials, session, or prior knowledge of the system.\n\n\n\n\nAn unauthenticated network attacker can use this primitive to place executable content in directories where it is later executed by the service, resulting in remote code execution under the Vault Service account. Altium Enterprise Server is fixed in 8.1.1; the issue has been remediated in Altium 365 (commercial and government cloud) at the service level."}],"affected":[{"vendor":"Altium","product":"Altium Enterprise Server","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"8.1.1","versionType":"semver"}],"platforms":["Web"],"modules":["Vault Service (ScriptsController)"]},{"vendor":"Altium","product":"Altium 365","defaultStatus":"affected","versions":[{"version":"unspecified","status":"affected"}],"platforms":["Web"],"modules":["Vault Service (ScriptsController)"]}],"references":[{"url":"https://www.altium.com/platform/security-compliance/security-advisories"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","subIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"CRITICAL","baseScore":10,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-22","lang":"en","description":"CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-306","lang":"en","description":"CWE-306 Missing Authentication for Critical Function","type":"CWE"}]}],"providerMetadata":{"shortName":"Altium","orgId":"4760f414-e1ae-4ff1-bdad-c7a9c3538b79","dateUpdated":"2026-06-09T16:06:03.926Z"},"datePublic":"2026-06-05T20:25:00.000Z","impacts":[{"capecId":"CAPEC-126","descriptions":[{"lang":"en","value":"CAPEC-126 Path Traversal"}]},{"capecId":"CAPEC-115","descriptions":[{"lang":"en","value":"CAPEC-115 Authentication Bypass"}]}],"credits":[{"lang":"en","value":"Joris Aerts, Tesla Inc.","type":"finder"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 1.0.2"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-06-08T13:11:55.450617Z","id":"CVE-2026-11429","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-06-08T13:12:06.589Z"}}]}}}