Auth bypass in Altium 365
CVE-2026-11429
Two endpoints in the Vault Service ScriptsController, shared by Altium Enterprise Server and Altium 365, accept file uploads where a user-supplied filename component is used to construct the destination path without validation, allowing ar…
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.011 (63.2th percentile) — read the EPSS interpretation.
Affected products
- Altium 365 — versions unspecified
- Altium Enterprise Server — versions 0