PT-2026-40634 · Unknown · Openplc V3

Unicorn-Hyh · Published 2026-05-13 · Updated 2026-05-15 · CVE-2026-31156

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenPLC v3 (2c82b0e79c53f8c1f1458eee15fec173400d6e1a)

Description A path injection issue exists in the binary program compiled from glue generator.cpp. The software fails to validate file path parameters passed via the command line, specifically the varName and varType parameters. These user-controlled inputs are passed directly to file operation functions such as fopen(), ifstream, and ofstream, allowing a remote attacker to read and write arbitrary files by constructing malicious paths.

Recommendations For version 2c82b0e79c53f8c1f1458eee15fec173400d6e1a, restrict access to the binary compiled from glue generator.cpp to prevent unauthorized command-line input. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2026-06814

CVE-2026-31156

Affected Products

Openplc V3

References · 6

• 🔥 https://github.com/unicorn-hyh/CVE-2026-31156 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-31156 · Security Note
• https://bdu.fstec.ru/vul/2026-06814 · Security Note
• https://sploitus.com/exploit?id=1708D9B1-2243-5D33-9F4D-720F9031E878&utm_source=rss&utm_medium=rss · Note
• https://github.com/advisories/GHSA-p6vg-5mm7-744x · Note
• http://openplc.com · Note