A critical path traversal vulnerability in OpenPLC Runtime v3 allows authenticated attackers to achieve remote code execution by overwriting arbitrary system files.

The application fails to validate the file path during the processing of uploaded Structured Text files, enabling a path traversal flaw (CWE-22) that permits arbitrary file writes. The vulnerability is accessible to authenticated users, though the presence of hardcoded default credentials significantly lowers the barrier to entry.

Successful exploitation grants an attacker the ability to overwrite sensitive system configuration files or inject malicious code into startup scripts. Given the CVSS score of 9.9, this vulnerability poses a catastrophic risk to system integrity and availability, potentially leading to a complete compromise of the underlying host and any connected industrial control systems.

Immediate Action: Upgrade to the latest version of OpenPLC v3 immediately to incorporate path validation logic into the compile_program function.

Proactive Monitoring: Review access logs for unusual file upload activity or attempts to access system directories such as /etc/ or /home/.

Compensating Controls: Change the default credentials (openplc:openplc) immediately and restrict network access to the OpenPLC web interface to trusted management subnets.

Public Exploit Available: No (exploit_available: unknown)

This is a critical vulnerability that requires immediate remediation. Administrators must prioritize updating the software and enforcing strong, unique credentials to prevent unauthorized access and potential remote code execution.