OpenPLC Runtime v3 enables authenticated users to upload files through a legacy web UI program‑upload interface. During upload the supplied filename (prog_file) is stored directly in a database field and later concatenated into a filesystem path without validation. Because Python os.path.join() respects absolute paths, an attacker can direct the upload to any location writable by the webserver process. After uploading a malicious C++ source file into the runtime core directory, normal operation of the PLC will compile that file into the executable binary, enabling arbitrary native code execution. This flaw is a CWE‑73 arbitrary file name or path manipulation that can compromise the confidentiality, integrity, or availability of the PLC host.

The vulnerability affects all OpenPLC Runtime v3 deployments that still expose the legacy program‑upload endpoint. All versions of OpenPLC v3 that include this UI component are susceptible; the description does not distinguish by minor release. OpenPLC v3 is no longer receiving security updates and the vendor recommends moving to OpenPLC v4, which removes the vulnerable upload workflow.

The CVSS score of 8.7 classifies this as a high‑severity vulnerability. The EPSS score of less than 1% indicates a low likelihood of exploitation, and the flaw is not currently listed in CISA’s KEV catalog. Exploitation requires authentication via the web UI; once logged in, an actor can write files to arbitrary locations and trigger compilation of malicious source code, leading to full remote code execution on the PLC host. Operators who maintain legacy OpenPLC v3 installations without patching remain at elevated risk.