CVE-2026-71268

CriticalCVSS 9.9

Published: 05/08/2026(UTC)Updated: 26/08/2026(UTC)Translated: 10/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.37%

29th percentile - higher than 29% of all known CVEs

Summary

OpenPLC Runtime v3's compile_program function parses directives from uploaded Structured Text (.st) files and writes referenced content without validating that the file path stays within the ./core directory. A path-validation function exists but is never invoked from compile_program.

Risk Assessment

An attacker can upload a malicious .st file that causes file writes outside the allowed directory, potentially leading to overwriting critical system files or code execution.

Recommendation

Integrate path validation into compile_program to ensure files are only written within the allowed directory. Also update to the latest OpenPLC version.

Other vulnerabilities in OpenPLC Runtime

CVE-2026-14480Critical
OpenPLC Runtime v3 has an authenticated arbitrary file write vulnerability in the legacy web UI program upload workflow. An attacker can supply an arbitrary filename stored in the database and used as the destination path without validation, allowing file writes anywhere writable by the webserver process.

Original NVD description (English source)

OpenPLC Runtime v3's compile_program function (webserver/openplc.py) parses directives from uploaded Structured Text (.st) program files and writes the referenced content to with no validation that file_path stays within the ./core directory. A path-validation function, validate_file_path, exists elsewhere in the codebase (webserver/credentials.py) but is never invoked from compile_program, leaving the sink unprotected.