CVE-2026-31156

CVSS 6.5 MEDIUMEPSS 0.4%CWE-22

Vexday Risk Score

33Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Proof of concept

Public proof of concept exists, but not yet automated.

CVSS 6.5EPSS 0.4%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

13 May 2026Published on NVD

13 May 2026Public PoC

Weaponization speed

same dayto first PoC

Weaponized quickly — attackers prioritized this vulnerability. Patch urgently.

Recommendation: Plan a near-term fix — a public PoC already exists.

A path injection vulnerability exists in OpenPLC v3 (2c82b0e79c53f8c1f1458eee15fec173400d6e1a) as the binary program compiled from glue_generator.cpp does not perform any validation on the file path parameters passed via the command line. The user-controlled input parameters are directly passed to the underlying file operation functions (fopen/ifstream/ofstream) for file reading and writing. An attacker can exploit this vulnerability by constructing a malicious path to read arbitrary readable files.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

n/a · n/a

public PoCs found — 1

githubgithub.com/unicorn-hyh/CVE-2026-31156★ 0

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

https://github.com/unicorn-hyh/CVE-2026-31156