CVE-2021-26828 OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type
Authenticated attackers can upload and execute arbitrary JSP files in OpenPLC ScadaBR, leading to remote code execution.
- Exploited in the wild
- Since 3 Dec 2025
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-26828?
CVE-2021-26828 is a high-severity vulnerability in n/a, published on 11 Jun 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm.
Weakness: CWE-434
Which versions are affected by CVE-2021-26828?
It affects 1 product.
Products include Scadabr Scadabr.
How do I fix CVE-2021-26828?
No fix has been published for CVE-2021-26828 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 24 Dec 2025.
Is CVE-2021-26828 being exploited?
Yes. Attackers have exploited CVE-2021-26828 in the wild since at least 3 Dec 2025.
Public exploit code: 3 proofs of concept on GitHub.
Other vulnerabilities in n/a
- CVE-2021-26829 OpenPLC ScadaBR Cross-site Scripting
- CVE-2026-9645 ScadaBR Authenticated Remote Code Execution
- CVE-2026-8602 Missing authentication for critical function in ScadaBR
- CVE-2026-8603 Improper neutralization of special elements used in an OS command ('OS command injection') in ScadaBR
- CVE-2026-8604 Cross-Site request forgery (CSRF) in ScadaBR
Sources
Also known as GHSA-j87g-5g8x-jjxc.