Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

OpenPLC Runtime v3 Allows Unauthorized File Writes

CVE-2026-71268 · published 1 month ago
Summary

An attacker can write files to arbitrary locations on the system using OpenPLC Runtime v3. This can potentially lead to remote code execution. It's essential to update OpenPLC to the latest version and change the default credentials to prevent exploitation.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
thiagoralves openplc_v3 <= *
Original advisory text
OpenPLC Runtime v3 Path Traversal in Structured Text FILE Directive Leading to Arbitrary File Write
OpenPLC Runtime v3's compile_program function (webserver/openplc.py) parses directives from uploaded Structured Text (.st) program files and writes the referenced content to with no validation that file_path stays within the ./core directory. A path-validation function, validate_file_path, exists elsewhere in the codebase (webserver/credentials.py) but is never invoked from compile_program, leaving the sink unprotected.
References
Severity
9.9 Critical
CVSS 3.1: 9.9 (NVD)
Exploitation
EPSS <1%
Type
CWE-22Path Traversal
Timeline
Published5 Aug 2026
Updated3 Sep 2026
First seen5 Aug 2026
Sources
CVE-2026-71268 · NVD
CVE-2026-71268 · MITRE
Monitor software like this
Free during beta