A path injection flaw in OpenPLC v3 allows an attacker to supply crafted command‑line arguments that the glue_generator binary forwards unvalidated to file handling APIs. This omission lets the attacker read any file that the process can access, directly exposing system files and potentially secret data. The weakness is centered on improper input validation and path traversal, giving attackers a read‑only confidentiality impact without any immediate denial of service or code execution claim.

OpenPLC v3 is affected. The vulnerability is present in the binary produced from glue_generator.cpp as referenced in the OpenPLC v3 source commit 2c82b0e79c53f8c1f1458eee15fec173400d6e1a. No additional version specifics are provided, so all builds including this commit are impacted.

The EPSS score is < 1% and it is not listed in the CISA KEV catalog. The CVSS score is 6.5. Publicly documented exploitation traffic is not reported. The attack vector is inferred to be local or remote if the glue_generator binary can be executed by an attacker, requiring command‑line access. The exposure is limited to files readable by the process, but on many systems this can include configuration files, logs, or other sensitive data. The lack of an official fix note means defenses must rely on patching or manual mitigation.