What is CVE-2025-27380?

CVE-2025-27380 is a high-severity vulnerability in Altium Aes, classified under Cross-site Scripting. CVSS score: 7.6/10. Published 2026-01-22.

How severe is CVE-2025-27380?

High severity. CVSS v3 base score is 7.6 out of 10.

XSS in Altium Aes

CVE-2025-27380

HTML injection in Project Release in Altium Enterprise Server (AES) 7.0.3 on all platforms allows an authenticated attacker to execute arbitrary JavaScript in the victim’s browser via crafted HTML content.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.002 (14.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N.

Affected products

Altium Aes — versions 7.0.3
Altium On-prem_enterprise_server

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

4760f414-e1ae-4ff1-bdad-c7a9c3538b79 (Vendor Advisory)

Frequently asked questions

What is CVE-2025-27380?: CVE-2025-27380 is a high-severity vulnerability in Altium Aes, classified under Cross-site Scripting. CVSS score: 7.6/10. Published 2026-01-22.
How severe is CVE-2025-27380?: High severity. CVSS v3 base score is 7.6 out of 10.