The OpenPLC Runtime v3's compile_program() function in webserver/openplc.py parses `(*FILE:path content*)` directives from uploaded Structured Text (.st) files and writes the referenced content to a path under './core' without validating that the file path remains within this directory. This lack of validation enables an attacker to craft a .st file with a path traversal payload (e.g., `(*FILE:../../../etc/cron.d/x * * * * root <command>*)`) to write arbitrary files anywhere on the filesystem. Although a path validation function exists elsewhere in the codebase, it is never called in this context, leaving the sink unprotected. The vulnerability allows remote code execution vectors such as cron jobs or SSH authorized_keys manipulation. Additionally, OpenPLC ships with hardcoded default credentials (openplc:openplc), which reduces the difficulty of exploitation. There is no vendor advisory or patch information available at this time.

Successful exploitation allows an attacker with at least limited privileges (due to the need for uploading .st files) to write arbitrary files anywhere on the filesystem, potentially leading to remote code execution. This can compromise confidentiality, integrity, and availability of the affected system. The presence of hardcoded default credentials increases the risk by making unauthorized access easier.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the upload functionality, change default credentials, and monitor for suspicious file uploads. Avoid using OpenPLC Runtime v3 in untrusted environments until the vulnerability is addressed.