Executive brief
OpenPLC Runtime v3, a programmable logic controller used in industrial environments, contains a security flaw in its legacy web interface. An authenticated user can upload malicious files to sensitive locations on the system. This can be used to take complete control of the controller, potentially disrupting industrial processes or damaging equipment.
Technical details
An authenticated arbitrary file write vulnerability exists in the legacy web UI program-upload workflow of OpenPLC Runtime v3. The application fails to validate the 'prog_file' parameter before storing it in the database and subsequently using it as a destination path for file uploads. Because the Python os.path.join() function honors absolute paths provided by an attacker, a user with low privileges can write files to any directory writable by the webserver. By placing a malicious .cpp file into the runtime core directory, the attacker can achieve native code execution when the system's default build pipeline automatically compiles and executes the new code during a normal program start. OpenPLC v3 is end-of-life; users are advised to migrate to v4.
Affected products
- OpenPLC OpenPLC Runtime v3
Timeline
- 2026-07-09: advisory: Initial publication by CISA (ICSA-26-190-01)
- 2026-07-10: disclosed: NVD publication date