CVE-2026-31156

MEDIUM

OpenPLC v3 - Path Traversal via Command Line File Path Parameters

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-31156. PoCs published by unicorn-hyh.

AI-analyzed exploit summary The repository provides a detailed technical analysis of CVE-2026-31156, an arbitrary file read vulnerability in OpenPLC-v3 due to improper input validation in `glue_generator.cpp`. It includes root cause analysis, attack prerequisites, and a proof-of-concept demonstration.

Description

A path injection vulnerability exists in OpenPLC v3 (2c82b0e79c53f8c1f1458eee15fec173400d6e1a) as the binary program compiled from glue_generator.cpp does not perform any validation on the file path parameters passed via the command line. The user-controlled input parameters are directly passed to the underlying file operation functions (fopen/ifstream/ofstream) for file reading and writing. An attacker can exploit this vulnerability by constructing a malicious path to read arbitrary readable files.

Exploits (1)

nomisec WRITEUP
by unicorn-hyh · poc
https://github.com/unicorn-hyh/CVE-2026-31156

The repository provides a detailed technical analysis of CVE-2026-31156, an arbitrary file read vulnerability in OpenPLC-v3 due to improper input validation in `glue_generator.cpp`. It includes root cause analysis, attack prerequisites, and a proof-of-concept demonstration.

Classification
Writeup 95%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: OpenPLC-v3
No auth needed
Prerequisites: ability to execute the vulnerable binary · read permissions for the target file
devstral-2 · analyzed May 13, 2026 Full analysis →

Scores

CVSS v3 6.5
EPSS 0.0041
EPSS Percentile 32.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-22
Status published
Products (1)
openplcproject/openplc_v3_firmware 2024-03-09
Published May 13, 2026
Tracked Since May 13, 2026