The PFI plugin framework deployment routine in PLCnext Engineer does not validate archive path components when extracting files into the local plugin repository. Archive entries containing relative path segments such as '..' are not rejected, letting an unauthenticated local attacker specify paths that resolve outside the intended directory. By crafting a malicious archive, the attacker can create or overwrite files wherever the current process has write permission, which may include system configuration files or executable binaries, resulting in full compromise of the device.

The vulnerability affects the Phoenix Contact PLCnext Engineer product, specifically the PFI plugin framework deployment component. No specific product versions are listed in the CNA data, so all released versions that include this deployment routine are potentially impacted.

With a CVSS score of 8.6 the flaw is considered high severity. The EPSS score is not available, but the lack of a KEV listing does not diminish the local exploitation risk. An attacker needing only file system access on the PLC can exploit the flaw by dropping a crafted archive in the plugin directory, triggering the insecure extraction routine. Because the attacker is local but unauthenticated, any user with standard privileges on the device can mount it, making the risk significant for environments where unauthorized local access is possible.