dbcve.org
Path TraversalWeakness · CWE-22

CVE-2026-9129

CRITICAL · 9.4 CVSS v4.0 Published 2026-05-20
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
100/100
Remediation priority · Urgent
Remotely reachable Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
A path traversal vulnerability exists in the Altium Enterprise Server Viewer StorageController due to improper handling of file path route parameters. On on-premise deployments that use local filesystem storage, a regular authenticated user can supply a URL-encoded absolute path (such as an encoded drive letter) in a Viewer storage API request, causing the configured storage root to be discarded and allowing arbitrary files to be read from the server filesystem. Because the readable files include the server's master configuration, which stores database credentials, signing key locations, certificate passwords, and OAuth secrets, exploitation can lead to disclosure of all server secrets and full compromise of the server and its data. Cloud deployments are not affected, as they use object storage and do not enable this component.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

The Altium Enterprise Server Viewer StorageController fails to properly validate URL-encoded file path parameters in storage API requests, allowing authenticated users to supply absolute paths that bypass the configured storage root directory. This path traversal enables arbitrary file read access across the server filesystem, including sensitive configuration files containing database credentials, signing keys, certificate passwords, and OAuth secrets.

MitigationApply vendor patch when available; as interim measure, restrict API access to trusted users and monitor for unusual path-encoded requests to the Viewer storage endpoints.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
Low
Authentication
X
User interaction
None
Scope
X

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Confirm Altium Enterprise Server installation and version
    Locate the Altium Enterprise Server installation directory, typically under the default installation path (often C:\Program Files\Altium\Enterprise Server or /opt/altium/enterprise-server). Check for version information in the server's About page, configuration files, or by querying the server's API endpoint for version metadata.
    Affected if The installed version falls within the affected range or cannot be determined (unknown versions should be treated as potentially affected).
  2. Verify Viewer StorageController module is enabled
    Access the Altium Enterprise Server administration console or configuration panel. Navigate to the Server Features or Modules section. Check whether the Viewer StorageController feature is listed as enabled or active.
    Affected if Viewer StorageController is enabled and exposed to users or network.
  3. Check StorageController API endpoint accessibility
    Examine the server's exposed API endpoints, typically found in the server's routing configuration or IIS/nginx reverse proxy settings. Look for endpoints under paths such as /api/Viewer/StorageController or similar storage-related API routes. Verify network exposure through firewall rules and URL accessibility.
    Affected if The StorageController API endpoint is externally accessible or accessible to untrusted networks.
  4. Confirm authentication configuration for StorageController API
    Review the server's authentication settings in the web.config, appsettings.json, or equivalent configuration file. Verify that the StorageController API endpoints require valid authentication and are not left anonymous or improperly configured.
    Affected if Authentication is disabled, misconfigured, or allows unauthenticated access to the StorageController API.
  5. Inspect storage root path configuration
    Locate the storage root path configuration in the server's configuration files (typically in the Viewer or StorageController settings section). Verify that the storage root is explicitly set to a restricted directory and that path validation logic exists to prevent traversal outside this root.
    Affected if Storage root path is not explicitly restricted or path validation is absent in the configuration.

Your environment is affected if Altium Enterprise Server with an enabled Viewer StorageController is running and the API endpoint is accessible with insufficient path validation or authentication controls.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

From vendor data
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Apply vendor patch when available; as interim measure, restrict API access to trusted users and monitor for unusual path-encoded requests to the Viewer storage endpoints.

Have this fixed Scoped from the published advisory
  • Consultation3.0 h
  • Implementation6.0 h
  • Testing3.0 h
  • Review / QA2.0 h
14.0 hours of engineering $2,490
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $3,984.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2026-9129 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2026-9129 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data