Insecure File Upload Vulnerability in OpenPLC Runtime
CVE-2025-54962

6.4MEDIUM

Key Information:

Vendor

Thiagoralves

Status
Openplc V3
Vendor
CVE Published:
4 August 2025

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2025-54962?

The OpenPLC Runtime versions from 3 up to 9cd8f1b contain a vulnerability that allows authenticated users to upload arbitrary files, including potentially malicious files such as .html or .svg. These uploaded files can be accessed publicly via the /static URI, exposing the system to various security risks. This issue underscores the importance of implementing stringent file upload validation mechanisms to protect against unauthorized data exposure and maintain the integrity of the web server.

Affected Version(s)

OpenPLC_v3 0 <= 9cd8f1b53a50f9d38708096bfc72bcbb1ef47343

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2025-54962
Created by Eyodav

References

https://github.com/thiagoralves/OpenPLC_v3/blob/9cd8f1b53...
https://github.com/Eyodav/OpenPLC-Insecure-File-Upload

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

.