OpenPLC Runtime v3’s compile_program function in the Python webserver processes uploaded Structured Text (.st) files and writes the content referenced by a FILE directive. It does not verify that the file_path stays within the intended ./core directory, leaving an unprotected write sink. This omission permits a path‑traversal attack that can create or overwrite any file that the web server process can access, resulting in an arbitrary file write on the host.

The flaw affects the OpenPLC v3 runtime developed by thiagoralves. No product version numbers are listed, so every deployed instance of OpenPLC v3 is potentially vulnerable.

The CVSS score of 9.9 classifies this issue as critical. However, the EPSS score of less than 1% indicates a very low yet non‑zero probability of exploitation at this time. The vulnerability is not included in CISA’s KEV catalog. An attacker can trigger the flaw remotely through the web server’s file upload interface by submitting a structured text file that contains a crafted FILE directive. When the server processes the upload, it writes the file using its own process user, which allows the attacker to overwrite configuration files, deploy malicious scripts, or otherwise modify the system filesystem.