The vulnerability in OpenPLC Runtime v3 arises from improper validation of the attacker-controlled filename parameter (prog_file) in the legacy web UI program-upload workflow. The filename is stored directly in the Programs.File database field and later used as the destination path for uploaded files without restricting or validating the path. Because Python's os.path.join() accepts absolute paths, an authenticated user can write arbitrary files anywhere writable by the OpenPLC webserver process. In the default build pipeline, all C++ source files in the runtime core directory are compiled into the executable. Thus, by writing a malicious .cpp file into this directory, an attacker can escalate the arbitrary file write to arbitrary native code execution when the operator triggers compilation and runtime start.

An authenticated attacker can write arbitrary files to any location writable by the OpenPLC webserver process, potentially leading to arbitrary native code execution. This can result in full compromise of the OpenPLC runtime environment, allowing execution of malicious code with the privileges of the webserver process.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the legacy web UI program-upload functionality to trusted users only and monitor for suspicious activity. Avoid triggering program compilation and runtime start with untrusted uploaded files.