CVE-2026-71268 in OpenPLC
Summary
by MITRE • 08/05/2026
OpenPLC Runtime v3's compile_program() function (webserver/openplc.py) parses `(*FILE:path content*)` directives from uploaded Structured Text (.st) program files and writes the referenced content to `os.path.join('./core', file_path)` with no validation that file_path stays within the ./core directory. A crafted .st file containing a directive such as `(*FILE:../../../etc/cron.d/x * * * * root <command>*)` writes attacker-controlled content to an arbitrary filesystem path, enabling remote code execution (e.g. via cron or SSH authorized_keys). A path-validation function, validate_file_path(), exists elsewhere in the codebase (webserver/credentials.py) but is never invoked from compile_program(), leaving the sink unprotected. OpenPLC additionally ships with hardcoded default credentials (openplc:openplc), lowering the practical bar for exploitation.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/05/2026
The vulnerability identified in OpenPLC Runtime v3 represents a critical path traversal flaw that directly enables remote code execution through improper input validation within the compile_program() function. This function processes Structured Text files containing specific directives that instruct the system to write content to designated file paths, creating a dangerous attack surface when combined with inadequate path validation mechanisms. The core issue stems from the absence of proper sanitization checks on user-provided file paths, allowing attackers to manipulate the target filesystem location through carefully crafted input data.
The technical flaw manifests in how the system handles the (FILE:path content) directive parsing mechanism within the webserver/openplc.py module. When processing uploaded .st program files, the function accepts arbitrary file paths without verifying that they remain confined to the intended ./core directory structure. This vulnerability aligns with CWE-22 Path Traversal and CWE-73 Path Traversal in Multiple Components categories, as it permits attackers to traverse the directory hierarchy beyond the designated boundaries. The system's failure to invoke the existing validate_file_path() function from webserver/credentials.py creates a critical gap in defensive measures, leaving the file writing operation completely unprotected against malicious path manipulation attempts.
The operational impact of this vulnerability is severe and multifaceted, potentially allowing attackers to achieve full system compromise through various attack vectors. By exploiting the path traversal capability, an attacker can write arbitrary content to system-critical files such as cron job configurations or SSH authorized_keys files, enabling persistent access and command execution capabilities. The attack surface extends beyond simple file writing operations to include potential privilege escalation scenarios where attackers might manipulate system-level configuration files or inject malicious code into running processes. This vulnerability operates at the intersection of multiple ATT&CK techniques including T1059 Command and Scripting Interpreter and T1078 Valid Accounts, leveraging both path traversal and credential abuse for maximum impact.
The presence of hardcoded default credentials (openplc:openplc) significantly reduces the attack threshold required to exploit this vulnerability, transforming what might otherwise be a complex multi-stage attack into a relatively straightforward exploitation scenario. This configuration flaw compounds the severity of the path traversal vulnerability by eliminating the need for credential brute-forcing or other authentication bypass techniques that would typically be required. Security practitioners should recognize that this combination creates an environment where attackers can achieve remote code execution with minimal initial access requirements, making the system particularly vulnerable in unsecured network environments or when deployed without proper network segmentation.
Mitigation strategies must address both the immediate path traversal vulnerability and the underlying credential management issues within the OpenPLC Runtime v3 implementation. The primary remediation involves implementing proper input validation by invoking the existing validate_file_path() function within compile_program() or creating equivalent sanitization mechanisms that ensure all file paths remain within the designated ./core directory boundaries. Additionally, administrators should immediately change the default credentials to strong, unique passwords and implement network-level access controls to limit exposure of the web interface. Regular security audits should verify that no other similar path traversal vulnerabilities exist within the codebase, particularly in functions handling user-provided file operations. The system should also implement proper logging and monitoring of file operations to detect potential exploitation attempts and maintain audit trails for forensic analysis purposes.