https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 19:36:53 +0000 https://cve.radiocsirt.org/vuln/cve-2026-71268 <p><strong>Affected:</strong> thiagoralves OpenPLC_v3</p> <p>OpenPLC Runtime v3&#39;s compile_program function (webserver/openplc.py) parses directives from uploaded Structured Text (.st) program files and writes the referenced content to with no validation that file_path stays within the ./core directory. A path-validation function, validate_file_path, exists elsewhere in the codebase (webserver/credentials.py) but is never invoked from compile_program, leaving the sink unprotected.</p> <p><strong>Affected:</strong> thiagoralves OpenPLC_v3</p> <p>OpenPLC Runtime v3&#39;s compile_program function (webserver/openplc.py) parses directives from uploaded Structured Text (.st) program files and writes the referenced content to with no validation that file_path stays within the ./core directory. A path-validation function, validate_file_path, exists elsewhere in the codebase (webserver/credentials.py) but is never invoked from compile_program, leaving the sink unprotected.</p> https://cve.radiocsirt.org/vuln/cve-2026-71268