PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-31156 OpenPLC Project CVE debrief

A path injection vulnerability in OpenPLC v3 (commit 2c82b0e79c53f8c1f1458eee15fec173400d6e1a) allows authenticated attackers to read arbitrary files on the system. The vulnerability exists in the glue_generator.cpp component, where user-supplied file paths passed via command-line arguments are used directly in file operations without validation. An attacker with local access can exploit this by providing malicious path sequences (e.g., directory traversal) to read sensitive files. The CVSS 3.1 score of 6.5 (MEDIUM) reflects network attack vector with low attack complexity, low privileges required, and high confidentiality impact with no integrity or availability impact. The vulnerability was published on May 13, 2026, and last modified on May 26, 2026. No known exploitation in the wild or ransomware campaign use has been documented.

Vendor
OpenPLC Project
Product
OpenPLC v3
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-13
Original CVE updated
2026-05-26
Advisory published
2026-05-13
Advisory updated
2026-05-26

Who should care

Organizations running OpenPLC v3 firmware version 2024-03-09 or earlier, particularly in industrial control system (ICS) environments where OpenPLC is deployed for programmable logic controller functionality. Security teams responsible for OT/ICS infrastructure, system administrators managing OpenPLC deployments, and developers maintaining OpenPLC forks or custom builds.

Technical summary

The glue_generator.cpp component in OpenPLC v3 fails to validate file path parameters supplied via command-line arguments before passing them to fopen, ifstream, and ofstream operations. This allows an attacker to inject path traversal sequences and read arbitrary files readable by the process. The vulnerability requires local access with low privileges and has been assigned CVSS 3.1 score 6.5 (MEDIUM).

Defensive priority

medium

Recommended defensive actions

  • Validate and sanitize all file path inputs in glue_generator.cpp before passing to file operation functions
  • Implement path canonicalization to resolve symbolic links and directory traversal sequences
  • Restrict file access to intended directories using chroot or similar containment mechanisms
  • Apply principle of least privilege to the glue_generator binary execution context
  • Monitor for anomalous file access patterns from OpenPLC processes
  • Review and update to patched version when available from vendor

Evidence notes

CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) identified in NVD record. Affected product confirmed as OpenPLC v3 firmware version 2024-03-09 per CPE criteria. Third-party exploit reference published to GitHub.

Official resources

Disclosed 2026-05-13; last modified 2026-05-26. No CISA KEV entry.