Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Vendor: thiagoralves Clear all filters
TI-2026-49936 CVE-2026-71268 · GHSA-qprq-675r-82h6

OpenPLC Runtime v3 Path Traversal in Structured Text FILE Directive Leading to Arbitrary File Write

Priority MEDIUM 44

OpenPLC Runtime v3's compile_program function (webserver/openplc.py) parses directives from uploaded Structured Text (.st) program files and writes the referenced content to with no validation that file_path stays within…

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.0058 Published 2026-08-05 No fix listed CWE-22
TI-2025-34678 CVE-2025-54962 · GHSA-5xhx-49mv-9j7j

Unrestricted file upload in thiagoralves OpenPLC_v3

Priority MEDIUM 62

/edit-user in webserver in OpenPLC Runtime 3 through 9cd8f1b allows authenticated users to upload arbitrary files (such as .html or .svg), and these are then publicly accessible under the /static URI.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00272 Published 2025-08-04 No fix listed CWE-434