EUVD-2026-53353
GHSA-qprq-675r-82h6
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network web upload (AV:N/AC:L), an authenticated session is needed (PR:L, eased by default creds), and arbitrary file write escapes the app into the host OS (S:C) for full RCE (C/I/A:H).
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
Lifecycle Timeline
2DescriptionCVE.org
OpenPLC Runtime v3's compile_program() function (webserver/openplc.py) parses (*FILE:path content*) directives from uploaded Structured Text (.st) program files and writes the referenced content to os.path.join('./core', file_path) with no validation that file_path stays within the ./core directory. A crafted .st file containing a directive such as (*FILE:../../../etc/cron.d/x * * * * root <command>*) writes attacker-controlled content to an arbitrary filesystem path, enabling remote code execution (e.g. via cron or SSH authorized_keys). A path-validation function, validate_file_path(), exists elsewhere in the codebase (webserver/credentials.py) but is never invoked from compile_program(), leaving the sink unprotected. OpenPLC additionally ships with hardcoded default credentials (openplc:openplc), lowering the practical bar for exploitation.
AnalysisAI
Arbitrary file write leading to remote code execution in OpenPLC Runtime v3 lets a low-privileged web user upload a crafted Structured Text (.st) program whose embedded (*FILE:path content*) directive escapes the intended ./core directory via path traversal. Because the compile_program() sink never calls the project's own validate_file_path() guard, an attacker can plant files such as a cron job or SSH authorized_keys to gain code execution as the runtime user. Exploitation is further eased by OpenPLC's shipped default credentials (openplc:openplc); no public exploit identified at time of analysis and the issue is not in CISA KEV.
Technical ContextAI
OpenPLC Runtime is an open-source soft-PLC / SCADA runtime that exposes a Flask-based web management interface (webserver/openplc.py) for uploading and compiling IEC 61131-3 Structured Text programs. The compile_program() function parses proprietary (*FILE:path content*) directives out of the uploaded .st file and writes the referenced content to os.path.join('./core', file_path). This is a textbook CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) flaw: os.path.join accepts an absolute or ../-laden file_path, so a value like ../../../etc/cron.d/x collapses the base prefix and resolves outside ./core. Notably a hardening routine, validate_file_path(), already exists in webserver/credentials.py but is never wired into this code path, leaving the sink completely unprotected.
RemediationAI
No vendor-released patch identified at time of analysis and no tagged fixed version is provided, so apply compensating controls now. First, immediately change the default openplc:openplc credentials to strong unique values, since default creds collapse the PR:L barrier. Second, restrict network access to the OpenPLC web interface (bind to localhost or place it behind a VPN/allowlisted firewall) so only trusted operators can reach the .st upload endpoint; the trade-off is loss of remote-management convenience. Third, until an upstream fix lands, disable or gate the program-upload/compile feature for untrusted users and run the runtime under a low-privilege, sandboxed account (no cron write access, non-writable authorized_keys) to blunt the file-write-to-RCE path; the trade-off is reduced ability to update ladder/ST logic. Track the upstream repository (https://github.com/thiagoralves/OpenPLC_v3) for a commit that wires the existing validate_file_path() check into compile_program(), and rebuild from that fix once published.
More in Openplc V3
View allAuthentication bypass in OpenPLC_V3 allows unauthenticated remote attackers to gain unauthorized system access through i
Plaintext credential storage in OpenPLC_V3 enables network-based attackers to retrieve authentication credentials withou
Denial of service and heap corruption in OpenPLC_v3 lets an authenticated web-interface user overflow the 100-byte MB_de
Authorization bypass in OpenPLC_V3 REST API allows authenticated low-privilege users to delete administrator accounts or
Same weakness CWE-22 – Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today