---
id: CVE-2026-110935
title: Path traversal in plug-in deployment
summary: >-
  The PFI plugin framework deployment routine does not validate path components
  when extracting archive entries to the local plugin repository. Archive
  entries containing relative path segments such as '..' are not rejected,
  allowing an un…
severity: high
cvss: 8.4
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-22
vendor: Phoenix Contact
product: PLCnext Engineer
affected:
  - plcnext_engineer >= 0.0 < 2026.6
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-04T20:10:56.660295Z'
published: '2026-11-04'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T20:11:15.848Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-110935'
references:
  - url: 'https://www.certvde.com/en/advisories/VDE-2026-121/'
tags:
  - cve.org
epss: 0.0019
epssPercentile: 0.08674
ingestedAt: '2026-11-05T21:36:00.534Z'
---

## Overview

The PFI plugin framework deployment routine does not validate path components when extracting archive entries to the local plugin repository. Archive entries containing relative path segments such as '..' are not rejected, allowing an unauthenticated local attacker to write files outside the plugin repository to arbitrary locations accessible with the current user's permissions which could result in full system compromise.

## Affected

- `plcnext_engineer >= 0.0 < 2026.6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.