CVE-2026-71268: OpenPLC Runtime v3 Path Traversal in Structured Text FILE Directive Leading to Arbitrary File Write
OpenPLC Runtime v3's compileprogram function (webserver/openplc.py) parses directives from uploaded Structured Text (.st) program files and writes the referenced content to with no validation that filepath stays within the ./core directory. A path-validation function, validatefilepath, exists elsewhere in the codebase (webserver/credentials.py) but is never invoked from compileprogram, leaving the sink unprotected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify compile_program() so that when parsing the (*FILE:path content*) directive from uploaded .st files, it calls the existing validate_file_path() function in webserver/credentials.py (or equivalent validation) and rejects/does not write if file_path would escape ./core. Ensure file_path is constrained to the ./core directory before performing os.path.join('./core', file_path).
OpenPLC Runtime v3 (webserver/openplc.py) path validation for FILE directive output = Use validate_file_path() for file_path before writing to os.path.join('./core', file_path) - Configuration
Replace the shipped hardcoded default credentials 'openplc:openplc' with unique credentials to reduce the practical bar for exploitation.
OpenPLC Runtime v3 default credentials (openplc:openplc) = Change/disable hardcoded default credentials - Compensating control
Constrain network access to the OpenPLC runtime service to trusted sources (e.g., only allow access from required IPs) to reduce the ability for attackers to upload crafted .st files for exploitation.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71268?
CVE-2026-71268 has a critical severity rating of 9.9.
What type of vulnerability is CVE-2026-71268?
CVE-2026-71268 is a Path Traversal vulnerability affecting OpenPLC Runtime v3.
How do I fix CVE-2026-71268?
To fix CVE-2026-71268, ensure that file path validation is implemented for the compile_program() function in OpenPLC Runtime.
What software is affected by CVE-2026-71268?
CVE-2026-71268 affects OpenPLC Runtime v3.
What can be the impact of CVE-2026-71268?
CVE-2026-71268 could lead to arbitrary file writes, potentially compromising system integrity.