OpenPLC Runtime v3's compile_program function parses directives from uploaded Structured Text (.st) program files and writes referenced content without validating that the file_path stays within the ./core directory. The codebase includes a validate_file_path function in webserver/credentials.py, but this function is never invoked by compile_program, resulting in an unprotected sink vulnerable to directory traversal (CWE-22). This allows an attacker with low privileges to write files outside the intended directory, potentially leading to full system compromise. The vulnerability has a CVSS 3.1 score of 9.9, indicating critical impact on confidentiality, integrity, and availability.

An attacker with low privileges can exploit this vulnerability to write files outside the intended directory, potentially overwriting or creating arbitrary files on the system. This can lead to complete system compromise, including unauthorized code execution, data corruption, or denial of service. The vulnerability affects confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using the vulnerable compile_program function with untrusted input or restrict file upload capabilities. Monitor vendor channels for official patches or updates addressing this issue.