CVE-2026-85690: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in plandex-ai plandex

CVE-2026-85690 is a path traversal vulnerability in plandex-ai's plandex product, specifically in version 2.2.1. The flaw exists in the ApplyFiles function, which improperly restricts pathname access, allowing attackers to write files outside the project directory. By influencing model output through poisoned repository files or attacker-controlled context, an attacker can write to arbitrary locations such as shell rc or cron files, enabling code execution. The vulnerability has a CVSS 4.0 score of 8.5, indicating high severity. There is no vendor advisory or patch information currently available, and the product is not a cloud service.

An attacker can exploit this vulnerability to write arbitrary files outside the intended directory, including critical system files like shell rc or cron files. This can lead to arbitrary code execution on the affected system. The vulnerability requires local attack vector with low complexity and no privileges, but user interaction is needed. The impact on confidentiality, integrity, and availability is high.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the ApplyFiles function or running plandex in a restricted environment to limit potential damage from exploitation.