A path injection vulnerability exists in OpenPLC v3 (2c82b0e79c53f8c1f1458eee15fec173400d6e1a) as the binary program compiled from glue_generator.cpp does not perform any validation on the file path parameters passed via the command line. The user-controlled input parameters are directly passed to the underlying file operation functions (fopen/ifstream/ofstream) for file reading and writing. An attacker can exploit this vulnerability by constructing a malicious path to read arbitrary readable files.
References
| Link | Resource |
|---|---|
| http://openplc.com | Product |
| https://github.com/unicorn-hyh/CVE-2026-31156 | Exploit Third Party Advisory |
| https://github.com/unicorn-hyh/CVE-2026-31156 | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
26 May 2026, 15:13
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:openplcproject:openplc_v3_firmware:2024-03-09:*:*:*:*:*:*:* cpe:2.3:h:openplcproject:openplc_v3:-:*:*:*:*:*:*:* |
|
| First Time |
Openplcproject
Openplcproject openplc V3 Openplcproject openplc V3 Firmware |
|
| References | () http://openplc.com - Product | |
| References | () https://github.com/unicorn-hyh/CVE-2026-31156 - Exploit, Third Party Advisory |
14 May 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-22 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
| References | () https://github.com/unicorn-hyh/CVE-2026-31156 - |
13 May 2026, 16:27
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-13 16:16
Updated : 2026-05-26 15:13
NVD link : CVE-2026-31156
Mitre link : CVE-2026-31156
CVE.ORG link : CVE-2026-31156
JSON object : View
Products Affected
openplcproject
- openplc_v3
- openplc_v3_firmware
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')