A path traversal flaw in the Altium Enterprise Server Collaboration Service lets an authenticated user embed a malicious filename in a collaboration message. The server later uses this unvalidated name to build a local file path during download, allowing the attacker to read any file on the server. Because the master configuration file, which holds privileged account credentials, is readable through this flaw, the attacker can obtain administrator credentials and gain full control of the server. The weakness originates from improper file path handling (CWE‑22) and inadequate authorization checks (CWE‑269).

On‑premises installations of Altium Enterprise Server are affected; the cloud‑based Altium 365 deployments are not impacted. The public advisory does not specify exact version numbers, so any instance that has not received the vendor’s fix is potentially vulnerable.

The CVSS score of 9.4 indicates a high severity vulnerability. No EPSS data is available and the issue is not listed in the CISA KEV catalog, but the lack of such data does not diminish its risk. Exploitation requires a valid authenticated session with the Collaboration Service, making the attack vector internal but nonetheless potent for privileged account compromise.