CVE-2026-71268: OpenPLC Runtime v3 Path Traversal in Structured Text FILE Directive Leading to Arbitrary File Write

OpenPLC Runtime v3's compileprogram() function (webserver/openplc.py) parses (FILE:path content) directives from uploaded Structured Text (.st) program files and writes the referenced content to os.path.join('./core', filepath) with no validation that filepath stays within the ./core directory. A crafted .st file containing a directive such as (FILE:../../../etc/cron.d/x root <command>) writes attacker-controlled content to an arbitrary filesystem path, enabling remote code execution (e.g. via cron or SSH authorizedkeys). A path-validation function, validatefilepath(), exists elsewhere in the codebase (webserver/credentials.py) but is never invoked from compileprogram(), leaving the sink unprotected. OpenPLC additionally ships with hardcoded default credentials (openplc:openplc), lowering the practical bar for exploitation.