{"id":"CVE-2026-110935","kind":"vulnerability","aliases":["CVE-2026-110935"],"related":[],"title":"Phoenix Contact PLCnext Engineer: plugin package can write files outside the plugin folder (path traversal)","description":"The PFI plugin framework deployment routine does not validate path components when extracting archive entries to the local plugin repository. Archive entries containing relative path segments such as '..' are not rejected, allowing an unauthenticated local attacker to write files outside the plugin repository to arbitrary locations accessible with the current user's permissions which could result in full system compromise.","summary":"The PFI plugin framework in PLCnext Engineer does not reject '..' path segments when extracting plugin archives, so a crafted plugin package can write files anywhere the current user can. Fixed in PLCnext Engineer 2026.6.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"PLCnext Engineer","fixed":["2026.6"],"affected":"< 2026.6","ecosystem":"vendor"}],"ecosystems":[],"tags":["ics","other","path-traversal","pfi","phoenix-contact","plcnext-engineer","plugin-framework"],"not_affected_if":[],"how_to_check":"Check the installed PLCnext Engineer version; anything before 2026.6 is affected.","fix":"Upgrade PLCnext Engineer to 2026.6. Until then install plugins only from trusted sources and verified engineering libraries.","status":"open","published_at":"2026-11-04T10:17:24+00:00","first_seen_at":"2026-11-04T10:26:34+00:00","triaged_at":"2026-11-04T10:27:05+00:00","updated_at":"2026-11-04T10:29:50+00:00","category":"other","confidence":0.9,"triage":{"at":"2026-11-04T10:27:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"PFI plugin framework: archive extraction lets files be written outside plugin folder","impact":"high","summary":"The PFI plugin framework does not reject '..' path segments when unpacking plugin archives, so an entry can write files to arbitrary locations. An attacker with local access could overwrite files as the current user, which could lead to full system compromise.","audience":"developers","category":"other","nicknames":[],"who_cares":["pfi","plugin-framework"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Arbitrary file writes as current user could lead to full system compromise","analyst_note":"Identify the affected PFI versions, the fixed release and the product vendor from the NVD entry and any advisory; the sources given name only NVD.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Systems that run the PFI plugin framework and its deployment routine that extracts plugin archives into the local plugin repository. The sources do not name the affected versions or deployment modes, so unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000627,"input_tokens":4132,"output_tokens":428,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the affected PFI versions, the fixed release and the product vendor from the NVD entry and any advisory; the sources given name only NVD.","search":"'-110935':18A,21A '-2026':17A,20A '2026.6':72B 'access':119C 'allow':104C 'anywher':63B 'arbitrari':117C 'archiv':54B,86C,93C 'attack':108C 'compon':83C 'compromis':132C 'contact':2A,32B 'contain':95C 'could':127C 'craft':57B 'current':65B,122C 'cve':16A,19A 'deploy':77C 'engin':4A,35B,45B,71B 'engineer':23A 'entri':87C,94C 'extract':52B,85C 'file':9A,62B,111C 'fix':68B 'folder':13A 'framework':38B,42B,76C 'full':130C 'ic':24B 'local':90C,107C 'locat':118C 'outsid':10A,112C 'packag':6A,59B 'path':14A,27B,49B,82C,97C 'path-travers':26B 'permiss':125C 'pfi':29B,40B,74C 'phoenix':1A,31B 'phoenix-contact':30B 'plcnext':3A,22A,34B,44B,70B 'plcnext-engin':33B 'plugin':5A,12A,37B,41B,53B,58B,75C,91C,114C 'plugin-framework':36B 'reject':48B,103C 'relat':96C 'repositori':92C,115C 'result':128C 'routin':78C 'segment':50B,98C 'system':131C 'travers':15A,28B 'unauthent':106C 'user':66B,123C 'valid':81C 'write':8A,61B,110C","nicknames":[],"mitigations":[],"who_affected":"Engineers who use Phoenix Contact PLCnext Engineer (1046008) before version 2026.6 and import plugin packages. A crafted plugin package can write files outside the plugin repository with the current user's permissions. Teams already on 2026.6 can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-04T10:29:50Z","by":"analyst","doc":"https://certvde.com/en/advisories/vde-2026-121/","run_id":1661},"products":{"at":"2026-11-04T10:29:50Z","by":"analyst","doc":"https://certvde.com/en/advisories/vde-2026-121/","run_id":1661},"how_to_check":{"at":"2026-11-04T10:29:50Z","by":"analyst","doc":"https://certvde.com/en/advisories/vde-2026-121/","run_id":1661},"who_affected":{"at":"2026-11-04T10:29:50Z","by":"analyst","doc":"https://certvde.com/en/advisories/vde-2026-121/","run_id":1661}},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["engineer","plcnextengineer"],"ptokens":["engineer","plcnext"],"labels":["high","ics","other","pathtraversal","pfi","phoenixcontact","plcnextengineer","pluginframework"],"campaign_type":null,"first_public_at":"2026-11-04T10:17:24+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"info@cert.vde.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110935","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110935","severity":null,"published_at":"2026-11-04T10:17:24+00:00","modified_at":"2026-11-04T10:17:24+00:00","first_seen_at":"2026-11-04T10:26:34+00:00","fetched_at":"2026-11-04T10:26:34+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-110935:1661","url":null,"severity":null,"published_at":"2026-11-04T10:29:50+00:00","modified_at":"2026-11-04T10:29:50+00:00","first_seen_at":"2026-11-04T10:29:50+00:00","fetched_at":"2026-11-04T10:29:50+00:00","note":"Primary: CERT@VDE VDE-2026-121 (Phoenix Contact). PLCnext Engineer < 2026.6, fixed in 2026.6. No exploitation/PoC found."}],"documents":[{"id":66166,"url":"https://certvde.com/en/advisories/vde-2026-121/","title":"VDE-2026-121 Phoenix Contact PLCnext Engineer","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}