OpenPLC v3 file write flaw enables code execution
An authenticated arbitrary file write bug in end-of-life OpenPLC v3's web UI can be escalated to arbitrary code execution via the runtime compilation process.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CISA has published an advisory for OpenPLC Runtime v3, an open-source programmable logic controller platform used across critical manufacturing, energy, transportation, and water/wastewater sectors worldwide. The vulnerability, tracked as CVE-2026-14480, stems from the legacy web UI's program-upload workflow, which stores an attacker-supplied filename directly into a database field and later uses it as a destination path without validation. Because Python's os.path.join() honors attacker-controlled absolute paths, an authenticated user can write files anywhere the OpenPLC webserver process has permission to write.
The more serious risk is escalation: the default OpenPLC build pipeline automatically compiles all C++ source files found in the runtime core directory into the executable binary. An attacker who writes a malicious .cpp file into that directory can achieve arbitrary native code execution as the OpenPLC runtime user simply by waiting for an operator to trigger a normal program compilation and runtime start — no additional exploitation primitives are needed.
OpenPLC v3 is end-of-life and will not receive a patch; the vendor's only remediation is migration to OpenPLC v4. CISA reports no known public exploitation at this time and recommends standard ICS network segmentation, firewalling, and secure remote access practices (VPNs) as compensating controls given the lack of a fix.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-190-01
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs