CVE-2026-71268

Name of the Vulnerable Software and Affected Versions OpenPLC Runtime version 3

Description The compile program() function in webserver/openplc.py fails to validate the file path variable when parsing (*FILE:path content*) directives from uploaded Structured Text (.st) program files. This allows an attacker to use path traversal sequences to write arbitrary content to any filesystem path outside the intended ./core directory, leading to remote code execution through mechanisms such as cron jobs or SSH authorized keys. The software also contains hardcoded default credentials (openplc:openplc), which facilitates exploitation.

Recommendations Update OpenPLC Runtime version 3 to a version where the compile program() function properly invokes the validate file path() function to ensure the file path remains within the intended directory. Change the default credentials from openplc:openplc to unique, strong passwords.