OpenPLC Runtime up to 3 Uploaded File os.path os.path.join prog_file unrestricted upload

Summaryinfo

A vulnerability identified as critical has been detected in OpenPLC Runtime up to 3. Affected is the function os.path.join of the file os.path of the component Uploaded File Handler. Performing a manipulation of the argument prog_file results in unrestricted upload. This vulnerability was named CVE-2026-14480. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability was found in OpenPLC Runtime up to 3. It has been classified as critical. This affects the function os.path.join of the file os.path of the component Uploaded File Handler. The manipulation of the argument prog_file with an unknown input leads to a unrestricted upload vulnerability. CWE is classifying the issue as CWE-434. The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

OpenPLC Runtime v3 contains an authenticated arbitrary file write vulnerability in the legacy web UI program‑upload workflow. The application stores an attacker‑supplied filename (prog_file) directly into the Programs.File database field and later uses this value as the destination path for an uploaded file without validating or restricting the path. Because Python os.path.join() honors attacker‑controlled absolute paths, an authenticated user can write arbitrary files anywhere writable by the OpenPLC webserver process. In the default build pipeline, all C++ source files within the OpenPLC runtime core directory are automatically compiled into the executable runtime binary. By writing a malicious .cpp file into this directory, an authenticated attacker can escalate the arbitrary file write into arbitrary native code execution when the operator triggers a normal program compilation and runtime start.

The advisory is shared at cisa.gov. This vulnerability is uniquely identified as CVE-2026-14480 since 07/02/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1608.002 for this issue.

Upgrading to version 4 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-43116). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• OpenPLC

Name

• Runtime

Version

• 3

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion