CVE-2026-14480

OpenPLC Runtime v3 contains an authenticated arbitrary file write vulnerability in the legacy web UI program‑upload workflow. The application stores an attacker‑supplied filename (prog_file) directly into the Programs.File database field and later uses this value as the destination path for an uploaded file without validating or restricting the path. Because Python os.path.join() honors attacker‑controlled absolute paths, an authenticated user can write arbitrary files anywhere writable by the OpenPLC webserver process. In the default build pipeline, all C++ source files within the OpenPLC runtime core directory are automatically compiled into the executable runtime binary. By writing a malicious .cpp file into this directory, an authenticated attacker can escalate the arbitrary file write into arbitrary native code execution when the operator triggers a normal program compilation and runtime start.

• CWE-73

• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-190-01.json
• https://www.cisa.gov/news-events/ics-advisories/icsa-26-190-01

Published

Jul 10, 2026

Last Modified

Jul 13, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-14474A flaw was found in SSSD's LDAP sudo provider. When the ldap…8.8
• CVE-2026-14475The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plug…4.9
• CVE-2026-14476A path traversal flaw was found in SSSD's AD GPO provider. T…8
• CVE-2026-14478A maliciously created executable, when executed on the victi…7.8
• CVE-2026-14479A maliciously crafted input, when processed by the Autodesk …5.5
• CVE-2026-1448A vulnerability was detected in D-Link DIR-615 up to 4.10. T…7.3
• CVE-2026-14481The Equalize Digital Accessibility Checker – WCAG, ADA, EAA …6.4
• CVE-2026-14482The 多说社会化评论框 plugin for WordPress is vulnerable to Privilege…8.8
• CVE-2026-14483The Realtyna Organic IDX plugin + WPL Real Estate plugin for…9.8
• CVE-2026-14487The Simple Coherent Form plugin for WordPress is vulnerable …9.1
• CVE-2026-14488The Meta Box AIO plugin for WordPress is vulnerable to Missi…9.1
• CVE-2026-14489The WHMCS Bridge plugin for WordPress is vulnerable to arbit…8.8