CVE-2026-9129: Altium Enterprise Server Path Traversal

CVE-2026-9129 Overview

CVE-2026-9129 is a path traversal vulnerability [CWE-22] in the Altium Enterprise Server Viewer StorageController. The flaw stems from improper handling of file path route parameters in on-premise deployments that use local filesystem storage. An authenticated user can submit a URL-encoded absolute path, such as an encoded drive letter, in a Viewer storage API request. The server discards the configured storage root and reads arbitrary files from the host filesystem. Cloud deployments are not affected because they use object storage and do not enable this component.

Critical Impact

Authenticated attackers can read the server's master configuration file, exposing database credentials, signing key locations, certificate passwords, and OAuth secrets, leading to full server compromise.

Affected Products

• Altium Enterprise Server Viewer (on-premise deployments using local filesystem storage)
• Altium Enterprise Server deployments with the Viewer StorageController component enabled
• Cloud deployments using object storage are not affected

Discovery Timeline

• 2026-05-20 - CVE-2026-9129 published to NVD
• 2026-05-20 - Last updated in NVD database

Technical Details for CVE-2026-9129

Vulnerability Analysis

The vulnerability resides in the Viewer StorageController route handler that maps user-supplied path parameters to objects on the local filesystem. The controller concatenates or joins the request path with the configured storage root without normalizing or validating the input against the root directory. When the input contains an absolute path, the underlying path-join semantics discard the configured root and resolve to the attacker-supplied location.

URL-encoding the absolute path bypasses any naive string checks at the route layer. Decoded values such as an encoded drive letter or leading separator reach the filesystem API as a fully qualified path. The server then opens and returns the contents of the targeted file in the API response.

A regular authenticated user is sufficient to trigger the issue. No administrative role or additional privilege is required. The read primitive extends to any file the server process can access, including the server's master configuration. That configuration stores database credentials, signing key paths, certificate passwords, and OAuth secrets, which together enable full takeover of the server and its data.

Root Cause

The root cause is missing canonicalization and containment checks on file path route parameters [CWE-22]. The StorageController trusts URL-decoded input and relies on string concatenation rather than resolving the final path and verifying it remains within the storage root.

Attack Vector

The attack vector is network-based and requires low-privilege authentication. An attacker issues an HTTP request to the Viewer storage endpoint with a URL-encoded absolute path as the route parameter. The server returns the contents of the targeted file, including sensitive configuration data.

No verified public exploit code is available. Refer to the Altium Security Advisories for vendor-supplied technical details.

Detection Methods for CVE-2026-9129

Indicators of Compromise

• Viewer storage API requests containing URL-encoded path separators (%2F, %5C) or drive letters (%3A) in the route parameter
• HTTP 200 responses from Viewer storage endpoints returning file content larger or different from expected artifact sizes
• Read access to the Altium Enterprise Server master configuration file from the Viewer service account at unexpected times
• Outbound authentication failures or anomalous logins to backing databases following Viewer API access

Detection Strategies

• Inspect web server and reverse proxy logs for requests to the Viewer StorageController that include encoded absolute path indicators in route parameters
• Alert on file reads by the Viewer service process against paths outside the configured storage root, such as system configuration directories
• Correlate authenticated Viewer storage requests with subsequent access to credentials, certificates, or signing keys stored on the server

Monitoring Recommendations

• Forward Altium Enterprise Server web access logs and host file-access telemetry to a centralized log platform for inspection
• Establish a baseline of normal Viewer storage paths and flag deviations, particularly requests targeting configuration directories
• Monitor for rotation events on database credentials, OAuth client secrets, and certificates after any suspected exploitation window

How to Mitigate CVE-2026-9129

Immediate Actions Required

• Apply the vendor fix referenced in the Altium Security Advisories as soon as it is available for your deployment
• Restrict network access to the Altium Enterprise Server Viewer endpoints to trusted users and management networks
• Rotate database credentials, OAuth client secrets, signing keys, and certificate passwords stored in the master configuration if exploitation is suspected
• Audit Viewer storage API logs for prior requests containing encoded absolute paths

Patch Information

Consult the Altium Security Advisories for fixed versions and upgrade guidance. No patch identifier was published in the NVD record at the time of writing.

Workarounds

• Migrate affected on-premise deployments to object storage where supported, since cloud deployments using object storage are not affected
• Place the Viewer storage endpoint behind a reverse proxy that rejects URL-encoded path separators and drive-letter patterns in route parameters
• Run the Viewer service under a least-privilege account that cannot read the master configuration or other sensitive files on disk
• Restrict authenticated Viewer access to a minimal set of users until the patch is applied

# Example reverse proxy rule to block encoded absolute paths in Viewer storage routes
# (nginx) - adapt path prefix to your deployment
location ~* /viewer/storage/ {
    if ($request_uri ~* "(%2[fF]|%5[cC]|%3[aA]|\.\./)") {
        return 400;
    }
    proxy_pass http://altium_backend;
}