CVE-2026-14480: OpenPLC Runtime v3 RCE Vulnerability

CVE-2026-14480 Overview

CVE-2026-14480 is an authenticated arbitrary file write vulnerability in OpenPLC Runtime v3, affecting the legacy web UI program-upload workflow. The application stores an attacker-supplied filename (prog_file) directly in the Programs.File database field and reuses it as the destination path for the uploaded file. Because Python os.path.join() honors attacker-controlled absolute paths, an authenticated user can write arbitrary files anywhere the OpenPLC webserver process can write. The flaw is tracked under [CWE-73: External Control of File Name or Path]. CISA published this issue in ICS Advisory ICSA-26-190-01, reflecting its relevance to operational technology (OT) environments.

Critical Impact
An authenticated attacker can drop a malicious .cpp file into the OpenPLC runtime core directory, causing arbitrary native code execution the next time an operator compiles and starts a program.

Affected Products

OpenPLC Runtime v3 (legacy web UI program-upload workflow)
Deployments using the default OpenPLC build pipeline that auto-compiles C++ sources in the runtime core directory
Industrial control system (ICS) environments exposing the OpenPLC web interface

Discovery Timeline

2026-07-10 - CVE-2026-14480 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-14480

Vulnerability Analysis

OpenPLC Runtime v3 exposes a legacy web UI that lets authenticated users upload PLC program files. The upload handler persists the client-supplied prog_file value into the Programs.File column and later concatenates it with a base directory using Python os.path.join(). The join operation does not sanitize or restrict the input, and os.path.join() discards the base path whenever an absolute path is supplied as the second argument. As a result, an authenticated attacker controls the exact filesystem destination of the uploaded content.

The impact escalates because the OpenPLC build pipeline automatically compiles every .cpp file located within the runtime core directory when an operator starts the runtime. Writing a crafted .cpp source file into that directory chains an authenticated file write into arbitrary native code execution inside the runtime process, which controls physical PLC logic.

Root Cause

The root cause is missing validation of the prog_file filename before it is used as a filesystem path. The code trusts a user-controlled string, stores it, and later uses it verbatim as the destination path for file writes. There is no allow-list of directories, no path normalization, and no rejection of absolute paths or traversal sequences.

Attack Vector

Exploitation requires network access to the OpenPLC web UI and valid credentials for the application. The attacker submits a program upload request in which the prog_file parameter contains an absolute path pointing into the OpenPLC runtime core source directory, with a .cpp extension. The malicious source file is written to disk. When an operator subsequently compiles and starts a program through the web UI, the build pipeline includes the attacker's source file, producing a runtime binary that executes attacker-controlled native code within the OpenPLC process context.

No verified public proof-of-concept code is available at the time of publication. Refer to the CISA ICS Advisory ICSA-26-190-01 and the GitHub CSAF JSON File for authoritative technical details.

Detection Methods for CVE-2026-14480

Indicators of Compromise

Unexpected .cpp, .c, or .h files appearing in the OpenPLC runtime core source directory outside of normal development activity.
Entries in the Programs.File database column containing absolute paths, path traversal sequences, or extensions other than the expected program file type.
Recent modifications to the compiled OpenPLC runtime binary that do not correspond to an authorized program change.
Web server access logs showing program-upload requests with suspicious prog_file values from unusual source IP addresses.

Detection Strategies

Monitor filesystem writes to the OpenPLC runtime core directory and alert on files written by the webserver process rather than by build tooling.
Inspect HTTP request bodies to the program-upload endpoint for absolute paths or directory separators in the prog_file field.
Baseline the set of source files that legitimately participate in the OpenPLC build and alert on any additions.
Correlate program-upload events with subsequent compile-and-start actions from the same session to identify exploitation chains.

Monitoring Recommendations

Forward OpenPLC webserver logs, operating system audit logs, and file integrity monitoring events to a central SIEM for correlation.
Enable file integrity monitoring (FIM) on the OpenPLC installation directory, especially the runtime core source tree and the compiled runtime binary.
Alert on any authentication to the OpenPLC web UI from networks that should not have management access to ICS assets.

How to Mitigate CVE-2026-14480

Immediate Actions Required

Restrict network access to the OpenPLC web UI to trusted management networks only, using firewall rules or network segmentation between IT and OT zones.
Rotate all OpenPLC web UI credentials and enforce strong, unique passwords for every operator account.
Audit the OpenPLC runtime core directory for unauthorized source files and remove any that were not introduced through the sanctioned development process.
Review the Programs.File database column for entries containing absolute paths or traversal sequences and remove suspicious records.

Patch Information

No vendor patch identifier is listed in the referenced advisories at publication time. Follow the CISA ICS Advisory ICSA-26-190-01 for updates on remediation guidance and any upstream fixes from the OpenPLC project. Until a fixed release is deployed, treat every OpenPLC Runtime v3 instance as vulnerable.

Workarounds

Place OpenPLC behind a VPN or jump host and require multi-factor authentication before any user can reach the web UI.
Run the OpenPLC webserver process as a low-privilege user whose write access is limited to a dedicated program upload directory, not the runtime core source tree.
Apply mandatory access controls (for example, AppArmor or SELinux profiles) that deny writes from the webserver process to the runtime source and build directories.
Disable or remove the legacy web UI upload workflow in environments where it is not operationally required.

bash

# Example AppArmor-style restriction concept for the OpenPLC webserver
# Deny writes to the runtime core source directory
deny /path/to/openplc/webserver/core/** w,
# Allow writes only to a dedicated uploads directory
/path/to/openplc/webserver/uploads/** rw,