unicorn-hyh/CVE-2026-31156

unicorn-hyh/CVE-2026-31156

GitHubGitHub
GitHubgithub.com
Releases0
There is a path injection vulnerability in OpenPLC-v3, which arises from the program not performing any validity checks on the file path parameters passed in from the command line. Attackers can read any readable file by constructing malicious paths, posing a risk of information leakage.
Log in to subscribe

CVE History

CVEPublishedCVSS v3CVSS v2
CVE-2026-31156↗
6.5 MEDIUM—

A path injection vulnerability exists in OpenPLC v3 (2c82b0e79c53f8c1f1458eee15fec173400d6e1a) as the binary program compiled from glue_generator.cpp does not perform any validation on the file path parameters passed via the command line. The user-controlled input parameters are directly passed to the underlying file operation functions (fopen/ifstream/ofstream) for file reading and writing. An attacker can exploit this vulnerability by constructing a malicious path to read arbitrary readable files.