Two endpoints in the Vault Service ScriptsController, shared by Altium Enterprise Server and Altium 365, accept file uploads where a user‑supplied filename component is used to construct the destination path without validation, creating a path‑traversal flaw (CWE‑22) and also a lack of authentication before file writing (CWE‑306). This allows arbitrary files to be written to any location writable by the Vault Service account. Because the file write completes before authentication is validated, the vulnerability can be exploited without any credentials, session, or prior knowledge of the system, giving an unauthenticated network attacker the ability to place executable content in directories that are later executed by the service, leading to remote code execution under the Vault Service account.

The vulnerability impacts Altium 365 and Altium Enterprise Server. Altium Enterprise Server is affected by versions prior to 8.1.1, which includes the Vault Service ScriptsController that accepts unvalidated file paths. Altium 365 has a service‑level fix that addresses the same flaw.

With a CVSS score of 10, the vulnerability is considered critical. The EPSS score is < 1 %, and the vulnerability is not listed in the CISA KEV catalog, indicating low current exploitation likelihood but still high potential impact. Because the file write completes before authentication is validated, the flaw can be abused by an unauthenticated attacker to deploy arbitrary code; the attacker can place executable files in locations that the Vault Service subsequently executes, leading to remote code execution under the Vault Service account.