plcnext_engineer vulnerabilities
CVEs whose affected-version data names the plcnext_engineer package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2026-110935High· 8.4Path traversal in plug-in deployment
The PFI plugin framework deployment routine does not validate path components when extracting archive entries to the local plugin repository. Archive entries containing relative path segments such as '..' are not rejected, allowing an un…
CVE-2026-110022High· 8.4Signed plug-in validation bypass
The PFI plugin framework deploys executable assemblies (DLLs) from a signed plugin package into the local plugin repository and loads them via reflection, but the deployment routine processes archive entries that were never covered by th…
CVE-2026-110021Medium· 6.2Missing GSDX SignatureValue verification
PLCnext Engineer checks GSDX manifest reference digests but does not cryptographically verify the XML `SignatureValue` over canonicalized `SignedInfo`. An unauthenticated local attacker can modify signed GSDML content, update its manifes…