CVE-2026-71268
Received Received - Intake

Path Traversal in OpenPLC Runtime

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
OpenPLC Runtime v3's compile_program() function (webserver/openplc.py) parses `(*FILE:path content*)` directives from uploaded Structured Text (.st) program files and writes the referenced content to `os.path.join('./core', file_path)` with no validation that file_path stays within the ./core directory. A crafted .st file containing a directive such as `(*FILE:../../../etc/cron.d/x * * * * root <command>*)` writes attacker-controlled content to an arbitrary filesystem path, enabling remote code execution (e.g. via cron or SSH authorized_keys). A path-validation function, validate_file_path(), exists elsewhere in the codebase (webserver/credentials.py) but is never invoked from compile_program(), leaving the sink unprotected. OpenPLC additionally ships with hardcoded default credentials (openplc:openplc), lowering the practical bar for exploitation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-71268
EUVD
EUVD-2026-53353

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
openplc runtime 3
thiagoralves openplc_runtime 3
thiagoralves openplc_runtime to 2026-04-01 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenPLC Runtime v3 has a flaw in its compile_program() function that processes Structured Text files. It allows writing arbitrary file content to any filesystem path by exploiting (*FILE:path content*) directives without proper path validation. This can lead to remote code execution if attacker-controlled files are placed in sensitive locations like cron jobs or SSH authorized_keys.

Detection Guidance

To detect this vulnerability, inspect OpenPLC Runtime v3 installations for .st files containing (*FILE: directives with path traversal sequences like ../../../. Check webserver/openplc.py for compile_program() function usage without validate_file_path() calls. Review filesystem writes to ./core directory for unexpected files.

Impact Analysis

An attacker could exploit this to execute arbitrary commands on your system with the privileges of the OpenPLC process. This could allow them to take full control of the system, steal data, or disrupt operations. The presence of hardcoded default credentials further lowers the barrier for exploitation.

Compliance Impact

This vulnerability could lead to unauthorized access, data breaches, or system compromise, violating confidentiality and integrity requirements in GDPR and HIPAA. Non-compliance risks include fines, legal action, and reputational damage due to exposed sensitive data.

Mitigation Strategies

Immediately update OpenPLC Runtime to a patched version if available. Remove hardcoded default credentials (openplc:openplc) and enforce strong authentication. Disable or restrict access to the web interface. Audit filesystem for unauthorized files in ./core or system directories like /etc/cron.d/. Apply input validation to file paths in compile_program().

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71268. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart