Skip to content
Sign in
8.6 High

CVE-2026-110935 Path traversal in plug-in deployment

Description

The PFI plugin framework deployment routine does not validate path components when extracting archive entries to the local plugin repository. Archive entries containing relative path segments such as '..' are not rejected, allowing an unauthenticated local attacker to write files outside the plugin repository to arbitrary locations accessible with the current user's permissions which could result in full system compromise.

CVSS 4.0 detail

Vector CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Exploitable with local access to the machine, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector
Local
Attack complexity
Low
Attack requirements
None
Privileges required
None
Interaction
None
Confidentiality
High
Integrity
High
Availability
High
Confidentiality of other systems
None
Integrity of other systems
None
Availability of other systems
None

Affected products and versions

Product Affected versions Fixed in
PLCnext Engineer 0.0 0.0 → < 2026.6 2026.6

Other CVEs of PLCnext Engineer

The 6 CVEs of PLCnext Engineer →
CVE-2026-110022 Signed plug-in validation bypass 8.6 High CVE-2026-110021 Missing GSDX SignatureValue verification 6.9 Medium CVE-2023-46144 A download of code without integrity check vulnerability in PLCnext products allows an remote attacker with low… 6.5 Medium CVE-2023-46142 A incorrect permission assignment for critical resource vulnerability in PLCnext products allows an remote attacker with… 8.8 High
Track this CVE