OpenPLC_v3 glue_generator Path Traversal — CVE-2026-31156

Metadata

Affected Target

Summary

glue_generator.cpp is a code-generation utility used in the OpenPLC_v3 build pipeline to parse a variable-definition header file and emit corresponding glue-code source. The tool accepts input and output file paths as command-line arguments without validating or restricting them to the expected project directory. An attacker able to influence the input file path argument (e.g. in an automated/CI build context, or a shared engineering workstation) can direct the tool to read and process a file outside the intended project tree, such as /etc/passwd, demonstrating unrestricted path traversal in a tool that is part of the PLC programming/build toolchain.

Vulnerability Details

Root Cause

glue_generator takes the input file path as a raw command-line argument and opens it directly with no path canonicalization or containment check against an expected project/working directory, allowing arbitrary absolute or relative (../) paths to be supplied.

Attack Vector

1. Attacker gains the ability to control or influence the arguments passed to glue_generator (e.g. via a compromised build script, CI job, or shared engineering environment for OpenPLC projects).
2. Attacker supplies a traversal path such as ../../../../../../../../../../etc/passwd as the input file argument instead of a legitimate variable-definition header.
3. glue_generator reads and processes the targeted file as if it were a normal input header, with its contents reflected into the generated glue-code output file.

Impact

Arbitrary file read (and, depending on how generated output is subsequently compiled/used, potential downstream code injection) within the OpenPLC build toolchain — relevant in industrial control system (ICS) engineering environments where build tooling may run with elevated trust.

Environment / Lab Setup

Target:   OpenPLC_v3 (github.com/thiagoralves/OpenPLC_v3) glue_generator.cpp build utility
Attacker: g++ toolchain to compile glue_generator, shell access to invoke it with crafted paths

Proof of Concept

PoC Script

See poc.txt in this folder.

1
2
3
4
5
6
7

g++ glue_generator.cpp -o glue_generator
touch test.h
touch whatever.cpp
./glue_generator test.h whatever.cpp

touch /etc/passwd_test_marker    # (illustrative; do not run against a real /etc/passwd)
./glue_generator ../../../../../../../../../../etc/passwd whatever.cpp

poc.txt documents the exact compile-and-run commands against the real upstream glue_generator.cpp source, demonstrating that supplying a traversal path as the input argument causes the tool to read and process a file well outside its intended project directory.

Detection & Indicators of Compromise

Signs of compromise:

• Generated glue-code output containing content that does not match any legitimate project variable-definition file
• Build tooling invocations referencing system paths (e.g. /etc/) as input arguments
• Unexpected file-read access by build utilities outside the expected project directory

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/unicorn-hyh/CVE-2026-31156 on 2026-07-05.