EUVD-2026-29960
GHSA-p6vg-5mm7-744x
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
A path injection vulnerability exists in OpenPLC v3 (2c82b0e79c53f8c1f1458eee15fec173400d6e1a) as the binary program compiled from glue_generator.cpp does not perform any validation on the file path parameters passed via the command line. The user-controlled input parameters are directly passed to the underlying file operation functions (fopen/ifstream/ofstream) for file reading and writing. An attacker can exploit this vulnerability by constructing a malicious path to read arbitrary readable files.
AnalysisAI
Path traversal in OpenPLC v3 allows authenticated remote attackers to read arbitrary files via unvalidated file path parameters passed to the glue_generator binary. The vulnerability affects command-line input handling in the compiled binary derived from glue_generator.cpp, where user-controlled paths are passed directly to file operation functions (fopen, ifstream, ofstream) without validation. Exploitation requires authentication but no user interaction, and no public exploit code has been identified at the time of analysis.
Technical ContextAI
The vulnerability stems from CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) in OpenPLC v3's glue_generator binary. The glue_generator.cpp source code compiles into an executable that accepts file path parameters via command-line arguments. These paths are passed directly to C++ standard library file operations (ifstream for reading, ofstream for writing) and C standard I/O functions (fopen) without any path canonicalization, validation, or restriction to an intended directory. This allows attackers to use path traversal sequences (e.g., '../../../etc/passwd') to access files outside the intended scope, leveraging the privileges of the OpenPLC process.
RemediationAI
Patch availability and version-specific remediation details are not provided in the available data. Organizations using OpenPLC v3 should consult the OpenPLC project's GitHub repository (https://github.com/thiagoralves/OpenPLC_v3) and official advisories for patched versions. Immediate compensating controls include: (1) Restrict command-line execution of the glue_generator binary to trusted administrators only via OS-level access controls (e.g., file permissions, SELinux policies); (2) Implement network segmentation to limit remote access to OpenPLC systems to authenticated, trusted management networks; (3) Monitor file access patterns and system logs for suspicious path traversal attempts (sequences containing '../' in glue_generator invocations); (4) If available, review source code patches in the GitHub repository for manual remediation guidance. The primary mitigation depends on a vendor-released patch validating all file path inputs before use in file operations.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today