CVE-2026-71268 Details

A remote code execution vulnerability exists in OpenPLC Runtime version 3. The issue arises in the compile_program() function within webserver/openplc.py, where the application improperly handles file directives in uploaded Structured Text (.st) program files. Specifically, the vulnerability allows for the writing of attacker-controlled content to arbitrary filesystem paths, bypassing directory restrictions. This is achieved by crafting a .st file with a directive that references a sensitive system file, such as a cron job or SSH authorized_keys file. The vulnerability is exacerbated by the presence of hardcoded default credentials, which facilitate exploitation.