Path Traversal Vulnerability in Plandex 2.2.1 by Plandex AI

CVE-2026-85690

What is CVE-2026-85690?

Plandex 2.2.1 is susceptible to a path traversal vulnerability within the ApplyFiles function. This flaw enables attackers to write files outside the designated project directory. By exploiting this vulnerability, malicious actors can manipulate model outputs using maliciously crafted repository files or context. This can lead to unauthorized file writes to critical system locations, such as shell rc files or cron files, potentially allowing arbitrary code execution.

References