CVE-2026-31156 Path traversal in n/a
An attacker can read arbitrary files by exploiting a path injection vulnerability in OpenPLC's command-line file operations.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-31156?
CVE-2026-31156 is a medium-severity path traversal vulnerability in n/a, published on 13 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A path injection vulnerability exists in OpenPLC v3 (2c82b0e79c53f8c1f1458eee15fec173400d6e1a) as the binary program compiled from glue_generator.cpp does not perform any validation on the file path parameters passed via the command line. The user-controlled input parameters are directly passed to the underlying file operation functions (fopen/ifstream/ofstream) for file reading and writing. An attacker can exploit this vulnerability by constructing a malicious path to read arbitrary readable files.
Weakness: CWE-22
Which versions are affected by CVE-2026-31156?
It affects 1 product.
Products include Openplcproject Openplc V3 Firmware.
How do I fix CVE-2026-31156?
No fix has been published for CVE-2026-31156 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-31156 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-31156 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in n/a
Sources
Also known as GHSA-p6vg-5mm7-744x.