---
id: CVE-2026-14480
title: |-
  OpenPLC Runtime v3 contains an authenticated arbitrary file write 
  vulnerability in the legacy web UI program‑upload workflow
summary: |-
  OpenPLC Runtime v3 contains an authenticated arbitrary file write 
  vulnerability in the legacy web UI program‑upload workflow. The 
  application stores an attacker‑supplied filename (prog_file) directly 
  into the Programs.File database fi…
severity: critical
cvss: 9.9
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'
cwe:
  - CWE-73
published: '2026-07-10'
updated: '2026-07-10'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-14480'
references:
  - url: >-
      https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-190-01.json
    label: ics-cert@hq.dhs.gov
  - url: 'https://www.cisa.gov/news-events/ics-advisories/icsa-26-190-01'
    label: ics-cert@hq.dhs.gov
tags:
  - nvd
epss: 0.00616
epssPercentile: 0.47232
ingestedAt: '2026-07-11T22:16:00.911Z'
---

## Overview

OpenPLC Runtime v3 contains an authenticated arbitrary file write 
vulnerability in the legacy web UI program‑upload workflow. The 
application stores an attacker‑supplied filename (prog_file) directly 
into the Programs.File database field and later uses this value as the 
destination path for an uploaded file without validating or restricting 
the path. Because Python os.path.join() honors attacker‑controlled 
absolute paths, an authenticated user can write arbitrary files anywhere
 writable by the OpenPLC webserver process. In the default build 
pipeline, all C++ source files within the OpenPLC runtime core directory
 are automatically compiled into the executable runtime binary. By 
writing a malicious .cpp file into this directory, an authenticated 
attacker can escalate the arbitrary file write into arbitrary native 
code execution when the operator triggers a normal program compilation 
and runtime start.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.