Altium Support Center Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in the Altium Support Center's AddComment endpoint. This issue arises from inadequate server-side input sanitization. While the client interface implements HTML escaping, the backend accepts and retains arbitrary HTML and JavaScript introduced through altered POST requests. The injected content is displayed exactly as entered when support cases are viewed by other users, including support staff with higher privileges. This behavior enables the execution of arbitrary JavaScript in the context of the victim's browser.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected JavaScript is executed in the context of the user viewing the support case.