CVE-2026-31156

Description

A path injection vulnerability exists in OpenPLC v3 (2c82b0e79c53f8c1f1458eee15fec173400d6e1a) as the binary program compiled from glue_generator.cpp does not perform any validation on the file path parameters passed via the command line. The user-controlled input parameters are directly passed to the underlying file operation functions (fopen/ifstream/ofstream) for file reading and writing. An attacker can exploit this vulnerability by constructing a malicious path to read arbitrary readable files.

Traduire en français

Produits concernés

• Openplcproject openplc v3 firmware

Scores CVSS

Faiblesses (CWE)

• CWE-22

Références

• https://github.com/unicorn-hyh/CVE-2026-31156 ExploitThird Party Advisory
• https://github.com/unicorn-hyh/CVE-2026-31156 ExploitThird Party Advisory

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories