unicorn-hyh/cve-2026-31156
There is a path injection vulnerability in OpenPLC-v3, which arises from the program not performing any validity checks on the file path parameters passed in from the command line. Attackers can read any readable file by constructing malicious paths, posing a risk of information leakage.
There is a path injection vulnerability in OpenPLC-v3, which arises from the program not performing any validity checks on the file path parameters passed in from the command line. Attackers can read any readable file by constructing malicious paths, posing a risk of information leakage.
Improper Input Validation (Path Injection)
Information Disclosure (Arbitrary File Read)
The binary program compiled from glue_generator.cpp contains an arbitrary file read vulnerability caused by insufficient validation of user-supplied file paths.
An attacker can specify an arbitrary file as the input argument (e.g., /etc/passwd) when executing the program. The application subsequently reads the file line by line, parses the content, and directly prints the parsed data to the console using cout without performing any validation on:
As a result, attackers can read any file accessible to the privilege context of the running process, leading to sensitive information disclosure.
1.The attacker is able to execute the vulnerable binary.
2.The running user account has read permission for the target file.
Successful exploitation may disclose sensitive system information, including but not limited to:
This information may facilitate further privilege escalation or lateral movement.
In glue_generator.cpp, the program uses two string arrays, varName and varType, to process and print parsed file contents to the command line.
During parsing, the program expects a specific line format:
(<varType>,<varName>,
Specifically:
the content between ( and the first , is assigned to varType;
the content between the first and second , is assigned to varName.
No validation is performed on the source file path or the legitimacy of the parsed data.
Step 1: Create a Test File
Create a file named test.txt with the following content:
(aaaaaaaa,123,
Step 2: Execute the Vulnerable Program
Run the following command:
./glue_generator ./test.txt whatever.cpp
The program will parse the content and print the extracted values to the console.
Step 3: Arbitrary File Read
If an attacker can modify or control a sensitive file (for example /etc/passwd) to include data matching the required format:
(aaaaaaaa,123,
the vulnerable program will parse and print the corresponding content from the file.
For sensitive files, any line matching the following pattern may be disclosed:
(<content1>,<content2>,
The amount of leaked information depends on:
The vulnerability is caused by:
1.Lack of validation for user-controlled file paths.
2.Unsafe parsing logic applied to arbitrary files.
3.Direct console output of parsed content without authorization checks.
4.Absence of restrictions on accessible file locations.
To mitigate the vulnerability: