CVE-2026-11419

The UploadController component improperly validates the user-controlled path when handling image upload requests. An attacker can provide a crafted absolute path that bypasses the configured storage root directory. As a result, files with content controlled by the attacker can be written anywhere in the file system accessible to the service account — including directories accessible through the browser or locations containing application binaries and configuration. The vulnerability requires having an account in the system (authentication), but does not require any administrative privileges.

An attacker can obtain remote code execution (RCE), take control of the service, or cause denial of service (DoS) by overwriting critical application or configuration files. Altium 365 cloud deployments are not vulnerable — the endpoint is unavailable, and the cloud storage architecture neutralizes the file write capability.

Patches available from the vendor should be applied in accordance with references published at https://www.altium.com/platform/security-compliance/security-advisories. Until the patch is deployed, it is recommended to restrict access to the UploadController endpoint to trusted networks only and monitor unexpected file writes by the service account.

Altium Enterprise Server (on-premises installations) with the Vault Service component containing UploadController; Altium 365 cloud deployments are not vulnerable. Specific versions are indicated in the vendor's references.