Executive brief
OpenPLC v3, an open-source Programmable Logic Controller used in industrial automation, contains a security flaw in its code generation component. An attacker with the ability to execute specific commands can bypass directory restrictions to read sensitive system files. This could lead to the exposure of passwords, configuration details, or other confidential data, potentially allowing for further unauthorized access to industrial control systems.
Technical details
A path injection (path traversal) vulnerability exists in the 'glue_generator.cpp' component of OpenPLC v3. The binary compiled from this source fails to validate command-line arguments before passing them to file operation functions like fopen, ifstream, and ofstream. An attacker with command execution privileges can provide a malicious path (e.g., /etc/passwd) as an input argument. The program then parses the file and outputs content matching a specific pattern ('(varType,varName,') to the console. This allows for the disclosure of sensitive information from any file the process has permissions to read.
Affected products
- OpenPLC Project OpenPLC v3 commit 2c82b0e79c53f8c1f1458eee15fec173400d6e1a
Timeline
- 2026-05-13: disclosed: Initial disclosure of CVE-2026-31156
- 2026-05-13: advisory: NVD publication date