CVE-2026-110935: Path traversal in plug-in deployment
The PFI plugin framework deployment routine does not validate path components when extracting archive entries to the local plugin repository. Archive entries containing relative path segments such as '..' are not rejected, allowing an unauthenticated local attacker to write files outside the plugin repository to arbitrary locations accessible with the current user's permissions which could result in full system compromise.
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attacker must have local access to the affected system and be able to supply a malicious plug-in archive. No authentication or prior privileges are required.
How much access could a successful exploit give the attacker?
The attacker can write files to locations outside the plug-in repository, limited by the permissions of the user running the deployment routine. This could lead to full system compromise.