CVE-2026-9102 Altium CVE debrief

Who should care

Altium Enterprise Server administrators, security teams operating workspace-upload workflows, and defenders responsible for monitoring authenticated upload paths, server filesystem integrity, and web-root exposure. Organizations that allow workspace users to submit Gerber files through ComparisonService should treat this as a high-priority exposure.

Technical summary

The CVE text describes a path traversal weakness in Altium Enterprise Server ComparisonService caused by missing filename sanitization in Gerber upload APIs. An authenticated user can influence the filename carried in the multipart Content-Disposition header, causing the server to write outside the intended temporary upload directory. Because the write primitive can reach arbitrary filesystem locations, impact includes unauthorized file placement, overwrite of application artifacts, denial of service, and potential remote code execution if a writable path maps to executable or web-accessible content. The NVD record assigns CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H, consistent with a network-reachable, low-complexity issue requiring low-privilege authentication.

Defensive priority

Immediate

Recommended defensive actions

• Review Altium's published security advisories for CVE-2026-9102 and apply vendor guidance or updates as soon as they are available.
• Restrict access to ComparisonService and Gerber upload functionality to the smallest feasible set of trusted users and networks.
• Validate that upload handlers normalize paths and reject crafted filenames before files are written to disk.
• Monitor temporary upload directories, application binaries, and configuration paths for unexpected file creation or modification.
• If unauthorized writes are suspected, perform a compromise assessment focused on web-accessible directories and service-account impacts, and rotate or redeploy affected systems as needed.

Evidence notes

This debrief is based only on the supplied CVE description, the NVD modified record, and the referenced official Altium security advisories URL. The CVE text explicitly states path traversal in Altium Enterprise Server ComparisonService via unsanitized filenames in Gerber file upload APIs, with arbitrary file write and possible RCE or service takeover. NVD metadata also lists CWE-22 and CWE-434 as secondary weakness references and includes an official reference to Altium's security advisories page. The structured vendor object is marked low-confidence/needs review, so vendor attribution should be treated cautiously even though the source text points to Altium.

Official resources