{"id":"CVE-2026-71268","aliases":["EUVD-2026-53353","GHSA-qprq-675r-82h6"],"status":"published","title":"OpenPLC Runtime v3 Path Traversal in Structured Text FILE Directive Leading to Arbitrary File Write","description":"OpenPLC Runtime v3's compile_program function (webserver/openplc.py) parses directives from uploaded Structured Text (.st) program files and writes the referenced content to with no validation that file_path stays within the ./core directory. A path-validation function, validate_file_path, exists elsewhere in the codebase (webserver/credentials.py) but is never invoked from compile_program, leaving the sink unprotected.","severity":{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0058,"percentile":0.48051,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22"],"published":"2026-08-05T12:26:15Z","modified":"2026-10-24T15:10:00Z","products":[{"vendor":"openplc_v3","product":"openplc_v3"},{"vendor":"thiagoralves","product":"openplc_v3"}],"references":[{"url":"https://github.com/thiagoralves/OpenPLC_v3","tags":["third-party-advisory"]},{"url":"https://github.com/thiagoralves/OpenPLC_v3/blob/master/webserver/openplc.py","tags":["third-party-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71268"},{"url":"https://github.com/advisories/GHSA-qprq-675r-82h6"}],"sources":{"cve":[{"id":"CVE-2026-71268","title":"OpenPLC Runtime v3 Path Traversal in Structured Text FILE Directive Leading to Arbitrary File Write","description":"OpenPLC Runtime v3's compile_program function (webserver/openplc.py) parses directives from uploaded Structured Text (.st) program files and writes the referenced content to with no validation that file_path stays within the ./core directory. A path-validation function, validate_file_path, exists elsewhere in the codebase (webserver/credentials.py) but is never invoked from compile_program, leaving the sink unprotected.","status":"published","published":"2026-08-05T12:26:15.867Z","modified":"2026-08-10T11:46:39.944Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:19:49.559463Z"}],"euvd":[{"id":"EUVD-2026-53353","description":"OpenPLC Runtime v3's compile_program function (webserver/openplc.py) parses directives from uploaded Structured Text (.st) program files and writes the referenced content to with no validation that file_path stays within the ./core directory. A path-validation function, validate_file_path, exists elsewhere in the codebase (webserver/credentials.py) but is never invoked from compile_program, leaving the sink unprotected.","status":"published","published":"2026-08-05T12:26:15Z","modified":"2026-08-10T11:46:39Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T18:02:05.732685Z"}],"ghsa":[{"id":"GHSA-qprq-675r-82h6","title":"OpenPLC Runtime v3's compile_program() function (webserver/openplc.py) parses `(*FILE:path...","description":"OpenPLC Runtime v3's compile_program() function (webserver/openplc.py) parses `(*FILE:path content*)` directives from uploaded Structured Text (.st) program files and writes the referenced content to `os.path.join('./core', file_path)` with no validation that file_path stays within the ./core directory. A crafted .st file containing a directive such as `(*FILE:../../../etc/cron.d/x * * * * root \u003ccommand\u003e*)` writes attacker-controlled content to an arbitrary filesystem path, enabling remote code execution (e.g. via cron or SSH authorized_keys). A path-validation function, validate_file_path(), exists elsewhere in the codebase (webserver/credentials.py) but is never invoked from compile_program(), leaving the sink unprotected. OpenPLC additionally ships with hardcoded default credentials (openplc:openplc), lowering the practical bar for exploitation.","status":"published","published":"2026-08-05T15:32:20Z","modified":"2026-08-05T15:32:21Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:10:06.632203Z"}],"nvd":[{"id":"CVE-2026-71268","description":"OpenPLC Runtime v3's compile_program function (webserver/openplc.py) parses directives from uploaded Structured Text (.st) program files and writes the referenced content to with no validation that file_path stays within the ./core directory. A path-validation function, validate_file_path, exists elsewhere in the codebase (webserver/credentials.py) but is never invoked from compile_program, leaving the sink unprotected.","status":"published","published":"2026-08-05T13:24:51.083Z","modified":"2026-10-24T15:10:00.19Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:12:35.031043Z"}]}}