CVE-2026-31156: Path Traversal
A path injection vulnerability exists in OpenPLC v3 (2c82b0e79c53f8c1f1458eee15fec173400d6e1a) as the binary program compiled from gluegenerator.cpp does not perform any validation on the file path parameters passed via the command line. The user-controlled input parameters are directly passed to the underlying file operation functions (fopen/ifstream/ofstream) for file reading and writing. An attacker can exploit this vulnerability by constructing a malicious path to read arbitrary readable files.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31156?
The CVE-2026-31156 vulnerability is considered to have a medium severity level due to its potential for path injection attacks.
How do I fix CVE-2026-31156?
To fix CVE-2026-31156, ensure the validation of file path parameters passed via the command line in OpenPLC v3.
Which versions of OpenPLC are affected by CVE-2026-31156?
OpenPLC v3 version 2c82b0e79c53f8c1f1458eee15fec173400d6e1a is the affected version for CVE-2026-31156.
What is a path injection vulnerability in the context of CVE-2026-31156?
Path injection vulnerability in CVE-2026-31156 refers to the lack of validation on user-controlled file path parameters which can lead to unauthorized access.
Who is the vendor for the OpenPLC software affected by CVE-2026-31156?
The vendor for the affected OpenPLC software is OpenPLC.