CVE-2026-14439
A critical path‑traversal flaw in Altium’s Git Service lets an authenticated user move files outside the intended repository, enabling remote code execution and cross‑tenant data access on multi‑tenant deployments. The issue is fixed in Altium Enterprise Server 8.1.1 and has been remediated in Altium 365 at the service level.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Altium Enterprise Server versions prior to 8.1.1 and Altium 365 (commercial and government cloud) deployments.
Real-world impact
An attacker could run arbitrary code on the Git Service account, potentially taking over the server or reading data from other tenants on the same infrastructure node.
Why this severity
The CVSS score of 9.4 reflects the combination of remote code execution, high impact on confidentiality, integrity, and availability, and the fact that only a low‑privilege authenticated user can trigger the vulnerability.
What to do about it
- 01Upgrade Altium Enterprise Server to version 8.1.1 or later.
- 02For Altium 365, verify that the service‑level remediation has been applied – contact Altium support if unsure.
NVD-referenced vendor advisory
Timeline
- Jul 1, 2026 · Jul 1, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 20, 2026 · 14d agoAdvisory updatedThe NVD record was last revised.
- Jul 21, 2026 · 14d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.