file upload exploit

The file upload exploit tag covers security reporting on vulnerabilities that abuse web-based upload or program-submission workflows to write files on a host. The current coverage focuses on CVE-2026-14480 in OpenPLC v3, where an authenticated, low-privilege user can reportedly provide a filename that is treated as a filesystem destination through the web UI’s program-upload process. Because the written content may support native code execution through compilation and runtime startup, the issue is especially relevant to industrial control system operators. Coverage also highlights that OpenPLC v3 is end-of-life, recommends upgrading to OpenPLC v4, and advises isolating legacy installations that cannot be migrated immediately.