CVE-2026-9102: Altium Enterprise Server Path Traversal

CVE-2026-9102 Overview

CVE-2026-9102 is a path traversal vulnerability [CWE-22] in the Altium Enterprise Server ComparisonService. The flaw exists in the Gerber file upload APIs, which fail to sanitize filenames supplied through the multipart Content-Disposition header. An authenticated workspace user can craft a filename containing directory traversal sequences to escape the temporary upload directory. The attacker can then write arbitrary files anywhere on the server filesystem.

Critical Impact

Authenticated attackers can write attacker-controlled files to web-accessible directories, achieving remote code execution under the service account, or overwrite application binaries and configuration files to cause service takeover or denial of service.

Affected Products

• Altium Enterprise Server (ComparisonService component)
• Gerber file upload APIs within the Enterprise Server workspace
• Deployments accepting authenticated workspace user uploads

Discovery Timeline

• 2026-05-20 - CVE-2026-9102 published to NVD
• 2026-05-20 - Last updated in NVD database

Technical Details for CVE-2026-9102

Vulnerability Analysis

The vulnerability resides in the Gerber file upload handlers of the Altium Enterprise Server ComparisonService. The service accepts multipart form uploads and uses the filename parameter from the Content-Disposition header to construct the destination path on disk. The handler concatenates this attacker-controlled value with the temporary upload directory without normalizing the path or rejecting traversal sequences.

A crafted filename such as one containing ..\ or ../ segments traverses outside the intended directory. Because the service runs with elevated privileges, the write primitive extends across the entire filesystem accessible to the service account. Authentication as any regular workspace user is the only prerequisite, lowering the bar for exploitation in multi-tenant deployments.

Root Cause

The root cause is missing filename sanitization on input received in the multipart Content-Disposition header. The upload handler trusts client-supplied filenames and omits canonicalization, traversal-character filtering, and allowlist validation against the resolved destination directory. This maps to [CWE-22] Improper Limitation of a Pathname to a Restricted Directory.

Attack Vector

The attack vector is network-based and requires low privileges. An attacker authenticates as a standard workspace user and submits a POST request to the Gerber upload endpoint. The multipart body contains a Content-Disposition header where the filename field encodes a traversal payload pointing to a target directory such as a webroot, application binary path, or configuration directory. The server writes attacker-supplied content to that path.

For full exploitation details, refer to the Altium Security Advisory. Public proof-of-concept code is not currently available.

Detection Methods for CVE-2026-9102

Indicators of Compromise

• Multipart upload requests to ComparisonService Gerber endpoints containing ..\, ../, or URL-encoded traversal sequences in the Content-Disposition filename field
• Newly created or modified files outside the configured temporary upload directory, particularly under web-accessible paths, application install directories, or service configuration directories
• Unexpected executable files, scripts, or DLLs appearing in directories owned by the Altium Enterprise Server service account
• Service binary or configuration file hashes deviating from known-good baselines after upload activity

Detection Strategies

• Inspect HTTP request logs and reverse proxy logs for multipart uploads where the filename parameter contains traversal characters or absolute path indicators
• Deploy file integrity monitoring on Altium Enterprise Server installation directories, webroots, and configuration paths
• Correlate authenticated workspace user sessions with subsequent filesystem write events outside expected upload directories
• Alert on process executions spawned from directories that should only contain uploaded user content

Monitoring Recommendations

• Enable verbose logging on the ComparisonService upload endpoints and forward to a centralized logging platform
• Monitor child process creation under the Altium Enterprise Server service account for anomalous executables
• Track outbound network connections initiated by the service process to identify post-exploitation command and control activity

How to Mitigate CVE-2026-9102

Immediate Actions Required

• Apply the vendor patch referenced in the Altium Security Advisory as soon as it is available for your deployment
• Restrict access to the Altium Enterprise Server workspace to trusted users and enforce strong authentication for all accounts
• Audit existing workspace user accounts and disable accounts that are unused or no longer required
• Review the filesystem for unauthorized files written outside expected upload directories since the service was deployed

Patch Information

Altium has published guidance through its security advisory portal. Consult the Altium Security Advisory for the current fixed version, patch identifiers, and upgrade instructions specific to your Enterprise Server release.

Workarounds

• Place the Altium Enterprise Server behind a web application firewall configured to block multipart requests containing traversal sequences in Content-Disposition filename fields
• Run the ComparisonService under a least-privileged service account with write access restricted to required directories only
• Enforce filesystem ACLs that deny the service account write permission to webroots, binary paths, and configuration directories where feasible
• Temporarily disable the Gerber upload functionality if business operations permit until a patched version is deployed

# Configuration example: WAF rule pattern to block traversal in multipart filenames
# Match Content-Disposition filename values containing traversal sequences
SecRule REQUEST_HEADERS:Content-Disposition "@rx filename=[^;]*(\.\./|\.\.\\|%2e%2e%2f|%2e%2e/)" \
    "id:1009102,phase:2,deny,status:400,log,msg:'CVE-2026-9102 path traversal attempt in upload filename'"