CVE-2026-31156: OpenPLC v3 Path Traversal Vulnerability

CVE-2026-31156 Overview

CVE-2026-31156 is a path injection vulnerability [CWE-22] in OpenPLC v3 at commit 2c82b0e79c53f8c1f1458eee15fec173400d6e1a. The binary compiled from glue_generator.cpp accepts file path parameters from the command line without validation. These user-controlled inputs flow directly into fopen, ifstream, and ofstream file operations. An attacker can supply a crafted path to read arbitrary files accessible to the OpenPLC process.

Critical Impact
Authenticated attackers can read sensitive files on the host by passing malicious paths to the glue_generator binary, leading to disclosure of configuration files, credentials, or other readable resources.

Affected Products

OpenPLC v3 at commit 2c82b0e79c53f8c1f1458eee15fec173400d6e1a
Builds containing the glue_generator binary compiled from glue_generator.cpp
Deployments exposing glue_generator to untrusted command-line input

Discovery Timeline

2026-05-13 - CVE-2026-31156 published to NVD
2026-05-14 - Last updated in NVD database

Technical Details for CVE-2026-31156

Vulnerability Analysis

The glue_generator utility in OpenPLC v3 parses runtime variable definitions and generates glue code that links the soft PLC runtime to its I/O layer. The program reads input definitions from a file and writes generated C/C++ source to an output file. Both paths are supplied on the command line.

The compiled binary takes those path strings and passes them directly to the C++ standard library file APIs. There is no canonicalization, allow-list check, or restriction to a working directory. As a result, paths such as ../../../../etc/passwd resolve normally and the file contents are read by the process.

Because the vulnerability targets a build-time helper, exploitation depends on contexts where glue_generator is invoked with attacker-influenced arguments. CI pipelines, automated build services, and web-driven build interfaces that wrap OpenPLC are the most realistic attack surfaces.

Root Cause

The root cause is missing input validation on file path parameters. glue_generator.cpp trusts argv values and forwards them to fopen, ifstream, and ofstream without checking for path traversal sequences, absolute paths, or symbolic links. This is a classic improper limitation of a pathname to a restricted directory weakness, classified as [CWE-22].

Attack Vector

An attacker with the ability to influence the arguments passed to glue_generator supplies a path pointing outside the intended working directory. When the binary opens the file, the process reads its contents and may include the data in the generated output, exposing it to the attacker. The same primitive can also be used to write generated content to attacker-chosen locations within the file system permissions of the process.

No verified exploit code is provided by the vendor. A proof-of-concept is referenced in the GitHub PoC for CVE-2026-31156 repository.

Detection Methods for CVE-2026-31156

Indicators of Compromise

Invocations of glue_generator with path arguments containing ../ sequences or absolute paths outside the OpenPLC build tree
Unexpected reads of sensitive files such as /etc/passwd, SSH keys, or environment files by the glue_generator process
Generated glue source files containing content from unrelated system files

Detection Strategies

Audit build logs and CI job histories for command lines invoking glue_generator with non-standard or user-supplied path arguments
Apply file integrity monitoring on the OpenPLC source tree to flag generated files containing unexpected content
Use endpoint telemetry to correlate glue_generator process execution with file open events on paths outside the project directory

Monitoring Recommendations

Log all command-line arguments for OpenPLC build tooling and forward them to a centralized log store for review
Alert on glue_generator processes that open files under /etc, /root, or user home directories
Restrict where the OpenPLC build pipeline can run and monitor for path traversal patterns in job parameters

How to Mitigate CVE-2026-31156

Immediate Actions Required

Restrict execution of glue_generator to trusted users and trusted build environments only
Remove any web or API surface that forwards untrusted input to glue_generator command-line arguments
Run OpenPLC build tooling under a least-privilege account that cannot read sensitive system files

Patch Information

No official vendor patch is referenced in the NVD entry for CVE-2026-31156 at publication. Track the OpenPLC Project Website and the OpenPLC v3 source repository for updates that add path validation to glue_generator.cpp. Until a fix is published, apply the workarounds below.

Workarounds

Wrap glue_generator in a launcher that canonicalizes input paths with realpath and rejects paths outside the project directory
Run the binary inside a chroot, container, or sandbox with no access to sensitive host files
Patch glue_generator.cpp locally to validate that input and output paths resolve within an allow-listed base directory before calling fopen, ifstream, or ofstream

bash

# Configuration example: constrain glue_generator using a sandboxed working directory
mkdir -p /opt/openplc/sandbox
cp ./input.csv /opt/openplc/sandbox/
firejail \
  --private=/opt/openplc/sandbox \
  --read-only=/etc \
  --noprofile \
  ./glue_generator /opt/openplc/sandbox/input.csv /opt/openplc/sandbox/glue.cpp