A path traversal flaw exists in the Altium Enterprise Server ComparisonService because the Gerber file upload APIs do not sanitize the filename supplied in the multipart Content‑Disposition header. An attacker who is a regular authenticated workspace user can supply a crafted filename that ascends directories and writes an arbitrary file to any location on the server filesystem. When the file is written under a web‑accessible directory, the flaw can be escalated to remote code execution in the context of the service account. Additionally, the attacker can overwrite application binaries or critical configuration files, resulting in service takeover or denial of service. The vulnerability is classified under CWE‑22 and CWE‑434 and is assigned a CVSS score of 9.4.

All deployments of Altium Enterprise Server, as the advisory does not list specific affected versions. The flaw resides in the ComparisonService component of the server.

The high CVSS score reflects severe confidentiality, integrity, and availability impact. EPSS is not available, so the precise exploitation likelihood cannot be quantified, but the lack of input validation makes successful attacks straightforward for any authenticated user. Chosen attack path is through normal user workflow: uploading a Gerber file with a malicious filename. No CISA KEV listing suggests that broader exploitation has not yet been reported, but the capability remains present.