Vulnerabilities

TI-2026-85000 CVE-2026-110935 · GHSA-gwv8-5mm7-6vg5

Path traversal in Phoenix Contact PLCnext Engineer plug-in deployment

LOW 38

The PFI plugin framework deployment routine does not validate path components when extracting archive entries to the local plugin repository.

CVSS 4.0HIGH 8.6 Local No auth No interaction EPSS 0.0019 Published 2026-11-04 Fixed in 2026.6 CWE-22

TI-2026-84999 CVE-2026-110022 · GHSA-3922-7ccf-5hwx

Signature check bypass in Phoenix Contact PLCnext Engineer

LOW 38

The PFI plugin framework deploys executable assemblies (DLLs) from a signed plugin package into the local plugin repository and loads them via reflection, but the deployment routine processes archive entries that were ne…

CVSS 4.0HIGH 8.6 Local No auth No interaction EPSS 0.00108 Published 2026-11-04 Fixed in 2026.6 CWE-494

TI-2026-84998 CVE-2026-110021 · GHSA-rr6j-2cpg-6832

Phoenix Contact PLCnext Engineer: missing GSDX SignatureValue verification

LOW 29

PLCnext Engineer checks GSDX manifest reference digests but does not cryptographically verify the XML `SignatureValue` over canonicalized `SignedInfo`.

CVSS 4.0MEDIUM 6.9 Local No auth No interaction EPSS 0.00062 Published 2026-11-04 Fixed in 2026.6 CWE-347

Vulnerabilities

Filters

Path traversal in Phoenix Contact PLCnext Engineer plug-in deployment

Signature check bypass in Phoenix Contact PLCnext Engineer

Phoenix Contact PLCnext Engineer: missing GSDX SignatureValue verification