CVE-2026-71268
CriticalCVSS 9.9Summary
The compile_program() function in OpenPLC Runtime v3 does not validate paths in (*FILE:...*) directives in Structured Text files, allowing arbitrary file writes outside the ./core directory. The existing validate_file_path() function is never called, enabling remote code execution via cron or SSH keys. Default credentials openplc:openplc lower the exploitation barrier.
Risk Assessment
An attacker can gain full control of the system by executing arbitrary commands with service privileges. This can lead to system takeover, data theft, or permanent damage.
Recommendation
Update OpenPLC to a patched version or apply a workaround, e.g., call validate_file_path() in compile_program(). Change default passwords and restrict panel access.
Original NVD description (English source)
OpenPLC Runtime v3's compile_program() function (webserver/openplc.py) parses `(*FILE:path content*)` directives from uploaded Structured Text (.st) program files and writes the referenced content to `os.path.join('./core', file_path)` with no validation that file_path stays within the ./core directory. A crafted .st file containing a directive such as `(*FILE:../../../etc/cron.d/x * * * * root <command>*)` writes attacker-controlled content to an arbitrary filesystem path, enabling remote code execution (e.g. via cron or SSH authorized_keys). A path-validation function, validate_file_path(), exists elsewhere in the codebase (webserver/credentials.py) but is never invoked from compile_program(), leaving the sink unprotected. OpenPLC additionally ships with hardcoded default credentials (openplc:openplc), lowering the practical bar for exploitation.