CVE-2026-71268

creationtimestamp| type| source ---|---|--- 2026-08-05 14:58:17+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msdrzssxzv22...

CVE-2026-71268 OpenPLC Runtime v3 Path Traversal in Structured Text FILE Directive Leading to Arbitrary File Write

OpenPLC Runtime v3's compileprogram function webserver/openplc.py parses directives from uploaded Structured Text .st program files and writes the referenced content to with no validation that filepath stays within the ./core directory. A path-validation function, validatefilepath, exists elsewhe...