CVE-2026-110935 is a vulnerability in the PFI plugin framework deployment routine where path components are not properly validated during archive extraction. This allows an unauthenticated local attacker to write files outside the intended plugin repository by using relative path segments like '..'. Exploitation can lead to full system compromise with the permissions of the current user.