Path Injection Vulnerability in OpenPLC Software
CVE-2026-31156

6.5MEDIUM

Key Information:

Vendor

OpenPLC

Status
OpenPLC
Vendor
CVE Published:
13 May 2026

What is CVE-2026-31156?

A path injection vulnerability was identified in OpenPLC that allows unvalidated file path parameters to be exploited. The compiled binary from glue_generator.cpp fails to validate these parameters, enabling an attacker to pass malicious paths that can read arbitrary files from the system. This vulnerability poses a significant risk as it can lead to unauthorized access to sensitive data by leveraging user-controlled input.

References

http://openplc.com
https://github.com/unicorn-hyh/CVE-2026-31156

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.