CVE-2021-26828: OpenPLC ScadaBR unrestricted file upload in view_edit.shtm

CVE-2021-26828 · Severity: critical · CVSS 8.8 · Exploited in the wild · Published 2025-12-03

OpenPLC ScadaBR is an open-source platform used for automation and monitoring in industrial environments. A security flaw allows an authorized user to upload malicious files to the system, which can then be executed to take full control of the server. This could lead to the disruption of industrial processes, theft of sensitive operational data, or a complete system shutdown.

Technologies: OpenPLC SCADABr. Vendors: OpenPLC.

Quick answers

Is CVE-2021-26828 exploited in the wild?
Yes. CVE-2021-26828 is known to be exploited in the wild, first recorded on 3 December 2025. Treat it as urgent.
How severe is CVE-2021-26828?
Critical severity, with a CVSS score of 8.8, published 3 December 2025.
Which products and versions are affected?
OpenPLC Project ScadaBR Linux up to 0.9.1, Windows up to 1.12.4.
Is there a fix for CVE-2021-26828?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2021-26828 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2021-26828?
Check whether you run OpenPLC SCADABr. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An unrestricted file upload vulnerability (CWE-434) exists in OpenPLC ScadaBR through version 0.9.1 on Linux and 1.12.4 on Windows. The flaw is located in the 'view_edit.shtm' component, which fails to properly validate file extensions or content types during the upload process. A remote attacker with low-level authentication can upload a malicious JavaServer Pages (JSP) file and access it via the web server to achieve arbitrary code execution. This vulnerability has been observed being exploited in the wild and is included in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Affected products

  • OpenPLC Project ScadaBR Linux up to 0.9.1, Windows up to 1.12.4

Timeline

  • 2021-06-11: disclosed: Initial NVD publication
  • 2025-12-03: kev added: Added to CISA KEV catalog due to active exploitation

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.