NVD security advisoryHigh
High advisory for The PFI plugin framework deployment rout
CVE-2026-110935 · Reported 4 Nov 2026
Full advisory details, affected packages, severity context, and original source.
Affected technology
The PFI plugin framework deployment routAffected product
Advisory overview
The PFI plugin framework deployment routine does not validate path components when extracting archive entries to the local plugin repository. Archive entries containing relative path segments such as '..' are not rejected, allowing an unauthenticated local attacker to write files outside the plugin repository to arbitrary locations accessible with the current user's permissions which could result in full system compromise.