PLCNEXT ENGINEER · CVE-2026-110935 · Other
FIX → 2026.6 ✓ verified
The PFI plugin framework in PLCnext Engineer does not reject '..' path segments when extracting plugin archives, so a crafted plugin package can write files anywhere the current user can. Fixed in PLCnext Engineer 2026.6.
first public Nov 4, 2026 · 2 sources
Running PLCnext Engineer? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Engineers who use Phoenix Contact PLCnext Engineer (1046008) before version 2026.6 and import plugin packages. A crafted plugin package can write files outside the plugin repository with the current user's permissions. Teams already on 2026.6 can skip it.
Who cares ics, path-traversal, pfi, phoenix-contact, plcnext-engineer, plugin-framework
Check the installed PLCnext Engineer version; anything before 2026.6 is affected.
Upgrade to 2026.6
The PFI plugin framework deployment routine does not validate path components when extracting archive entries to the local plugin repository. Archive entries containing relative path segments such as '..' are not rejected, allowing an unauthenticated local attacker to write files outside the plugin repository to arbitrary locations accessible with the current user's permissions which could result in full system compromise.
This page as .md · .json · in your agent: get_signal("CVE-2026-110935") · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.