Description

Plandex 2.2.1 contains a path traversal vulnerability in the ApplyFiles function that allows attackers to write files outside the project directory. Attackers can influence model output through poisoned repository files or attacker-controlled context to write to arbitrary locations like shell rc or cron files, achieving code execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-04T15:17:46.947Z",
  "pubdate": "2026-09-04T15:17:46.947Z",
  "executiveSummary": "Plandex version 2.2.1 is vulnerable to a critical path traversal vulnerability within its ApplyFiles function. This flaw allows remote or local attackers to perform arbitrary file writes outside of the designated project directory.\nBy exploiting this vulnerability, an attacker can manipulate the application's file-writing behavior, potentially leading to unauthorized modification of critical system files. The primary risk associated with this vulnerability is remote code execution (RCE).\nAn attacker can influence the model's output, either through poisoned repository files or by supplying attacker-controlled context, to force the application to write malicious payloads into sensitive directories.\nSpecifically, writing to shell configuration files (such as .bashrc or .zshrc) or system cron directories allows the attacker to execute arbitrary commands with the privileges of the running process.\nThis vulnerability poses a severe threat to the host system, as it requires minimal interaction once the poisoned context is processed by the model. Organizations using Plandex 2.2.1 should immediately restrict write permissions, audit project file inputs, and upgrade to a secure version to mitigate the risk of full system compromise.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient input validation and sanitization within the ApplyFiles function of Plandex version 2.2.1. When processing file write operations initiated by the underlying language model or user-supplied templates, the application fails to properly restrict target file paths to the boundaries of the active project directory.\nThis lack of restriction enables directory traversal sequences (such as '../') to be resolved literally, allowing files to be created or overwritten anywhere on the filesystem where the application process has write permissions.\nThe attack flow typically begins with an attacker poisoning the context available to the model. This can be achieved by committing malicious files to a repository that the Plandex agent analyzes, or by directly feeding manipulated prompts into the model's context window. Because the model relies on these inputs to determine file paths and contents during the code generation phase, it can be induced to generate file write instructions containing path traversal sequences.\nWhen the model executes the ApplyFiles function with these poisoned parameters, the application processes the traversed path (e.g., writing to a user's shell rc file) without verification. The application then writes the attacker-controlled content to the specified location.\nPost-exploitation impact is extremely high. By writing to startup scripts like .bashrc, .profile, or user-specific cron tables, the attacker ensures that their payload executes automatically when a user logs in or when the cron daemon runs scheduled tasks. This allows the attacker to establish persistent access, execute arbitrary shell commands, or pivot further into the internal network.\nBecause the vulnerability leverages the trusted execution context of the AI assistant, traditional security controls may fail to detect the initial stage of the attack, which occurs entirely within standard model processing flows. No high-level privileges are required from the attacker beyond the ability to influence the model's input context."
}