CVE-2026-31156 is a path injection vulnerability in OpenPLC v3 (commit 2c82b0e79c53f8c1f1458eee15fec173400d6e1a). The binary compiled from glue_generator.cpp fails to validate file path parameters passed via the command line. User-supplied input is directly passed to file operation functions such as fopen, ifstream, and ofstream without sanitization. This allows an attacker to craft malicious file paths to read arbitrary readable files on the system. The vulnerability requires low attack complexity and no user interaction, with a low privilege attacker able to exploit it remotely. The impact is high confidentiality loss but no integrity or availability impact. No official fix or patch is currently documented.

An attacker with low privileges can exploit this vulnerability to read arbitrary files on the system that the OpenPLC process has access to. This results in a high confidentiality impact. There is no impact on integrity or availability. The vulnerability does not require user interaction and can be exploited remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected binary and limit the ability of untrusted users to invoke it with arbitrary command line parameters. Monitor for suspicious usage of the glue_generator.cpp binary. Avoid running the vulnerable version in sensitive environments if possible.