Path Traversal Vulnerability in Plandex

Plandex version 2.2.1 contains a critical path traversal vulnerability within its ApplyFiles function. This flaw arises from insufficient validation of file paths during the file application process, which is intended to update or create files within a designated project directory. An attacker who can influence the model's output, either through poisoned repository files or by supplying malicious context to the AI model, can force Plandex to write files to arbitrary locations on the host filesystem. By targeting sensitive directories, such as those containing shell initialization scripts (.bashrc, .zshrc) or cron job configurations, an attacker can achieve unauthorized code execution under the context of the user running the Plandex tool. This vulnerability represents a significant security risk for developers using Plandex in environments where the AI model's context might be influenced by untrusted sources.

Attack Chain

1. The attacker identifies or creates a malicious repository file or manipulates the Plandex project context.
2. The attacker triggers the Plandex model to generate a file update or creation action involving the ApplyFiles function.
3. The model output is crafted to include path traversal sequences (e.g., ../../../) within the filename parameter.
4. The ApplyFiles function fails to sanitize the provided path, allowing the write operation to escape the target project directory.
5. The Plandex process performs an unauthorized write to a sensitive system or user location, such as ~/.bashrc.
6. The target system or user triggers the malicious file (e.g., upon new shell login or cron execution).
7. Arbitrary code defined by the attacker is executed on the host system.

Impact

Successful exploitation allows attackers to gain remote code execution on the host machine running Plandex. This can lead to full system compromise, data exfiltration, or the establishment of persistent backdoors. Targeted environments include any developer workstation or server instance where Plandex is used to process code or configuration files.

Recommendation

1. Upgrade Plandex to a version addressing CVE-2026-85690 immediately once available from the vendor.
2. Review logs for unexpected file write operations originating from the Plandex process.
3. Isolate Plandex operations in a containerized or sandboxed environment with restricted filesystem access to mitigate the impact of path traversal.