Project and affected component
GSDX device-description import and PFI plug-in deployment before version 2026.6.
Security boundary
Package signatures and archive paths must constrain the content accepted and deployed by engineering software.
Vulnerability class
CWE-347 signature verification, CWE-494 code integrity, and CWE-22 path traversal.
CVE-2026-110021
GSDX import checked manifest digests without verifying SignatureValue, allowing modified device descriptions to appear valid.
CVE-2026-110022
Unsigned entries could overwrite verified plug-in assemblies during deployment, permitting attacker-supplied code to load.
CVE-2026-110935
Archive traversal could write outside the plug-in repository with the current user's permissions.
Root cause
Signature checks did not cover all accepted content, and extraction did not confine archive paths.
Public evidence
CERT@VDE VDE-2026-121 documents all three findings, researcher credit, and the fixed release.
Practical impact
Under the advisory conditions, manipulated packages could alter engineering data, load untrusted code, or write outside the intended directory.
Disclosure status
Published November 4, 2026 in CERT@VDE VDE-2026-121, with credit to Ievgen Bondarenko.
Remediation
Upgrade to PLCnext Engineer 2026.6, as recommended by Phoenix Contact.