CVE-2026-31156

Vulnerability

Overview

The binary program compiled from glue_generator.cpp in OpenPLC v3 (commit 2c82b0e79c53f8c1f1458eee15fec173400d6e1a) contains a path injection vulnerability. The application does not perform any validation on file path parameters passed via the command line, directly passing user-controlled input to file operation functions such as fopen, ifstream, and ofstream [1]. This lack of input validation allows an attacker to specify arbitrary file paths.

Exploitation

An attacker who can execute the vulnerable binary can supply a malicious path (e.g., /etc/passwd) as an argument. The program reads the file line by line, parses its content, and prints the parsed data to the console using cout without checking file path legitimacy, content format, or access restrictions [1]. The only prerequisite is that the running user account has read permission for the target file.

Impact

Successful exploitation leads to arbitrary file read, enabling disclosure of sensitive system information such as user account details, password hashes, configuration files, private keys, and application secrets [1]. This information could facilitate further privilege escalation or lateral movement within the environment.

Mitigation

As of the publication date, no patch has been released for this vulnerability. Users should restrict execution of the vulnerable binary to trusted users and apply the principle of least privilege to limit the files accessible by the process. Monitoring for unusual file access patterns may help detect exploitation attempts.