---
id: "CVE-2026-110935"
kind: "vulnerability"
aliases: ["CVE-2026-110935"]
title: "Phoenix Contact PLCnext Engineer: plugin package can write files outside the plugin folder (path traversal)"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "PLCnext Engineer", "fixed": ["2026.6"], "affected": "< 2026.6", "ecosystem": "vendor"}]
ecosystems: []
tags: ["ics", "other", "path-traversal", "pfi", "phoenix-contact", "plcnext-engineer", "plugin-framework"]
not_affected_if: []
published_at: "2026-11-04T10:17:24+00:00"
first_seen_at: "2026-11-04T10:26:34+00:00"
updated_at: "2026-11-04T10:29:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110935", "first_seen_at": "2026-11-04T10:26:34+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T10:29:50+00:00"}]
---

# Phoenix Contact PLCnext Engineer: plugin package can write files outside the plugin folder (path traversal)

The PFI plugin framework in PLCnext Engineer does not reject '..' path segments when extracting plugin archives, so a crafted plugin package can write files anywhere the current user can. Fixed in PLCnext Engineer 2026.6.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:PLCnext Engineer affected < 2026.6 fixed 2026.6

## How to check

Check the installed PLCnext Engineer version; anything before 2026.6 is affected.

## Fix

Upgrade PLCnext Engineer to 2026.6. Until then install plugins only from trusted sources and verified engineering libraries.

## Timeline

- 2026-11-04T10:26:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110935
- 2026-11-04T10:29:50+00:00 analyst — Primary: CERT@VDE VDE-2026-121 (Phoenix Contact). PLCnext Engineer < 2026.6, fixed in 2026.6. No exploitation/PoC found.

## Documents

- [advisory] VDE-2026-121 Phoenix Contact PLCnext Engineer https://certvde.com/en/advisories/vde-2026-121/

## From the sources

The PFI plugin framework deployment routine does not validate path components when extracting archive entries to the local plugin repository. Archive entries containing relative path segments such as '..' are not rejected, allowing an unauthenticated local attacker to write files outside the plugin repository to arbitrary locations accessible with the current user's permissions which could result in full system compromise.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_