CVE-2026-11414

An attacker who can reach the server over the network is able to forge valid file download URL signatures by using a hardcoded cryptographic key (CWE-798) that is common to all installations — without any authentication, session, or credentials. Then, by exploiting a path traversal vulnerability (CWE-22) in the same download endpoint, the attacker can escape the configured storage root directory and read arbitrary files from the server's file system. The combination of both vulnerabilities enables obtaining sensitive configuration files and the server's key material. The vulnerability can be combined with CVE-2026-9152 to enumerate and mass download stored contents.

An unauthenticated attacker can read arbitrary files from the server's file system, including sensitive configuration and cryptographic keys, which can lead to complete server takeover. Altium 365 installations using cloud object storage are practically not exposed.

Patches available from the vendor should be applied according to references (https://www.altium.com/platform/security-compliance/security-advisories). Until the patch is deployed, it is recommended to restrict network access to Altium Enterprise Server only to trusted hosts and monitor unexpected requests to the Vault file download endpoint.

Altium Enterprise Server — on-premises local installations using the Vault service with local file system; versions indicated in vendor references. Altium 365 (cloud deployments) are not vulnerable.