CVE-2026-11431

Executive Summary

CVE-2026-11431 is a critical path traversal vulnerability in the Projects Service download endpoint of Altium Enterprise Server and Altium 365. An authenticated attacker can craft a malicious path parameter to bypass validation, enabling arbitrary file read from the server filesystem, including entire directories returned as archives. This allows exfiltration of service configuration files and credential material, which can be leveraged for lateral movement and further compromise. The vulnerability is particularly dangerous in multi-tenant Altium 365 deployments, where exposed credentials could affect multiple services. Altium Enterprise Server is fixed in version 8.1.1; Altium 365 has been remediated at the service level. No public proof-of-concept code is available at this time.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects the proprietary Altium Enterprise Server and Altium 365 cloud services.

CVSS Breakdown & Threat Level

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Base Score: 6.5 (Medium)

Vector String Breakdown:

• Attack Vector (AV): Network – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low – No special conditions are required for exploitation.
• Privileges Required (PR): Low – An attacker must have a valid user account on the Altium service.
• User Interaction (UI): None – No user interaction is required.
• Scope (S): Unchanged – The vulnerable component and the affected resource are in the same security authority.
• Confidentiality (C): High – Arbitrary file read can expose sensitive configuration and credentials.
• Integrity (I): None – No data modification is possible.
• Availability (A): None – No denial of service impact.

Threat Level: High (due to the potential for credential theft and lateral movement in multi-tenant environments).

Deep Dive & Mechanics

The vulnerability resides in the Projects Service download endpoint, which is used to retrieve project files. The endpoint accepts a path parameter to specify the file or directory to download. Due to insufficient validation, an attacker can supply a path containing traversal sequences (e.g., ../) to escape the intended project directory.

Root Cause: The application fails to properly sanitize or canonicalize the user-supplied path before passing it to the file system. This allows an attacker to read arbitrary files outside the project root, including:

• Service configuration files (e.g., appsettings.json, web.config)
• Credential stores (e.g., connection strings, API keys, passwords)
• System files (e.g., /etc/passwd, /etc/shadow on Linux, or SAM on Windows)

Attack Flow:

1. Authenticate to the Altium service (Enterprise Server or Altium 365).
2. Identify the vulnerable download endpoint (e.g., /ProjectsService/Download?path=).
3. Craft a request with a path traversal payload, such as ../../../../etc/passwd or ../../../../appsettings.json.
4. The server returns the contents of the requested file, or if a directory is specified, returns an archive (ZIP) of the directory contents.

Chained Exploitation: The advisory notes that this issue can be combined with CVE-2026-11424 to reach the cloud-side endpoint, potentially allowing an attacker to pivot from an on-premise Enterprise Server to the Altium 365 cloud infrastructure.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

[HttpGet]
public IActionResult Download(string path)
{
    string fullPath = Path.Combine(_baseProjectDirectory, path);
    if (System.IO.File.Exists(fullPath))
    {
        return File(System.IO.File.ReadAllBytes(fullPath), "application/octet-stream");
    }
    else if (Directory.Exists(fullPath))
    {
        // Return directory as ZIP
        // ...
    }
    return NotFound();
}

The vulnerability is that path is not validated for traversal sequences. Path.Combine does not prevent ../ from escaping the base directory.

Patched Code (Conceptual):

[HttpGet]
public IActionResult Download(string path)
{
    string fullPath = Path.GetFullPath(Path.Combine(_baseProjectDirectory, path));
    if (!fullPath.StartsWith(_baseProjectDirectory))
    {
        return Forbid();
    }
    if (System.IO.File.Exists(fullPath))
    {
        return File(System.IO.File.ReadAllBytes(fullPath), "application/octet-stream");
    }
    else if (Directory.Exists(fullPath))
    {
        // Return directory as ZIP
        // ...
    }
    return NotFound();
}

The fix uses Path.GetFullPath to canonicalize the path and then checks that the resulting path starts with the intended base directory, preventing traversal.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid user credentials for the Altium service.
• Network access to the vulnerable endpoint.

Exploitation Steps:

1. Identify the Endpoint: Use a web proxy or browser developer tools to find the download endpoint. It is typically under /ProjectsService/Download?path= or similar.
2. Craft the Payload: Use path traversal sequences to read sensitive files.
   • Example: ../../../../appsettings.json (Windows) or ../../../../etc/passwd (Linux)
3. Execute the Request:

   curl -u "username:password" "https://target.altium.com/ProjectsService/Download?path=../../../../appsettings.json"
   

4. Exfiltrate Data: The server will return the file contents. For directories, the server returns a ZIP archive.
5. Chain with CVE-2026-11424: If the target is an Enterprise Server, use the credentials obtained to access the Altium 365 cloud endpoint.

No public exploit code is available.

Blue Team

Detection Steps:

1. Monitor for Path Traversal Patterns: Look for requests containing ../, ..\\, or URL-encoded variants (%2e%2e%2f, %2e%2e%5c) in the path parameter.
2. Alert on Unusual File Access: Detect access to files outside the expected project directories (e.g., appsettings.json, web.config, /etc/passwd).
3. Review Authentication Logs: Check for repeated failed login attempts followed by successful exploitation attempts.
4. Honeypot Files: Deploy decoy files (e.g., honeypot_credentials.txt) in the project directory and alert on any access.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /ProjectsService/Download with path parameter containing ../ or ..\\.
• Unusual outbound data transfers from the Altium server, especially of configuration files.
• Connections to unknown external IPs after exploitation.

File System IOCs:

• Unexpected access to files outside the project directory (e.g., appsettings.json, web.config, /etc/passwd).
• Creation of temporary ZIP archives in the server's temp directory.

Log IOCs:

• Web server logs showing 404 or 403 errors followed by successful 200 responses for path traversal attempts.
• Application logs showing Path.Combine or GetFullPath errors.

Detection Engineering

YARA Rule

rule CVE_2026_11431_Path_Traversal_Altium {
    meta:
        description = "Detects path traversal attempts targeting Altium Enterprise Server / Altium 365 Projects Service download endpoint"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-11431"
    strings:
        $traversal1 = "../" ascii wide nocase
        $traversal2 = "..\\" ascii wide nocase
        $traversal3 = "%2e%2e%2f" ascii wide nocase
        $traversal4 = "%2e%2e%5c" ascii wide nocase
        $endpoint = "/ProjectsService/Download" ascii wide nocase
        $config_file = "appsettings.json" ascii wide nocase
        $passwd = "/etc/passwd" ascii wide nocase
    condition:
        any of ($traversal*) and $endpoint and (any of ($config_file, $passwd))
}

Sigma Rule

title: CVE-2026-11431 - Path Traversal in Altium Projects Service
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects path traversal attempts against Altium Enterprise Server / Altium 365 download endpoint
author: Valters IT
date: 2026-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-11431
logsource:
    category: webserver
    product: iis
    service: http
detection:
    selection:
        cs-uri-query|contains:
            - '../'
            - '..\\'
            - '%2e%2e%2f'
            - '%2e%2e%5c'
        cs-uri-stem|contains: '/ProjectsService/Download'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in project files (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-11431 - Altium Projects Service Path Traversal"; flow:to_server,established; content:"/ProjectsService/Download"; http_uri; content:"../"; http_uri; nocase; sid:1000001; rev:1; reference:cve,2026-11431;)

Remediation & Mitigation

Immediate Actions:

1. Patch Altium Enterprise Server: Upgrade to version 8.1.1 or later.
2. Altium 365 Users: No action required; the service has been remediated at the service level.
3. If patching is not possible:
   • Implement a Web Application Firewall (WAF) rule to block path traversal patterns in the path parameter.
   • Restrict network access to the Altium service to trusted IPs only.
   • Monitor logs for exploitation attempts.

Long-Term Mitigations:

• Conduct a security audit of all Altium services for similar vulnerabilities.
• Implement input validation and canonicalization for all file path parameters.
• Use least-privilege principles for service accounts.
• Rotate any credentials that may have been exposed.

Valters IT