OpenPLC Runtime v3 Path Traversal in Structured Text FILE Directive Leading to Arbitrary File Write
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.9epss 0.4%
probabilidade de exploração
0.4%top 70% das CVEs
exploração observada
nãonenhuma fonte reporta
OpenPLC Runtime v3's compile_program function (webserver/openplc.py) parses directives from uploaded Structured Text (.st) program files and writes the referenced content to with no validation that file_path stays within the ./core directory. A path-validation function, validate_file_path, exists elsewhere in the codebase (webserver/credentials.py) but is never invoked from compile_program, leaving the sink unprotected.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
thiagoralves · OpenPLC_v3