OpenPLC ScadaBR contains an unrestricted file upload vulnerability that allows authenticated users to upload and execute arbitrary JSP files through the view_edit.shtm endpoint. This vulnerability enables remote code execution on affected systems. The flaw affects the open-source SCADA system and could potentially impact various industrial control systems implementations. A fix has been developed and is available through the SCADA-LTS project repository.