CVE-2026-14480

Received Received - Intake

Authenticated Arbitrary File Write in OpenPLC Runtime

Publication date: 2026-07-10

Last updated on: 2026-07-10

Assigner: ICS-CERT

Description

OpenPLC Runtime v3 contains an authenticated arbitrary file write vulnerability in the legacy web UI program‑upload workflow. The application stores an attacker‑supplied filename (prog_file) directly into the Programs.File database field and later uses this value as the destination path for an uploaded file without validating or restricting the path. Because Python os.path.join() honors attacker‑controlled absolute paths, an authenticated user can write arbitrary files anywhere writable by the OpenPLC webserver process. In the default build pipeline, all C++ source files within the OpenPLC runtime core directory are automatically compiled into the executable runtime binary. By writing a malicious .cpp file into this directory, an authenticated attacker can escalate the arbitrary file write into arbitrary native code execution when the operator triggers a normal program compilation and runtime start.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-10

Last Modified

2026-07-10

Generated

2026-07-11

AI Q&A

2026-07-11

EPSS Evaluated

N/A

NVD

CVE-2026-14480

EUVD

EUVD-2026-43116

Affected Vendors & Products

Vendor	Product	Version / Range
openplc	runtime	3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-73	The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

Executive Summary

This vulnerability exists in OpenPLC Runtime v3's legacy web UI program-upload workflow, where an authenticated user can supply a filename that is stored directly without validation. Because the application uses Python's os.path.join() which respects absolute paths, the attacker can write arbitrary files anywhere writable by the webserver process.

By writing a malicious C++ source file (.cpp) into the OpenPLC runtime core directory, the attacker can escalate this file write into arbitrary native code execution when the operator compiles and starts the runtime.

Impact Analysis

This vulnerability can have severe impacts including full compromise of the OpenPLC system. An authenticated attacker can write arbitrary files and escalate to executing arbitrary native code, potentially leading to complete control over the affected system.

The CVSS v3.1 base score of 9.9 indicates critical severity with high impact on confidentiality, integrity, and availability.

Hi! I’m here to help you understand CVE-2026-14480. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70