OpenPLC Runtime v3's compile_program() function (webserver/openplc.py) parses `(*FILE:path content*)` directives from uploaded Structured Text (.st) program fil…

OpenPLC Runtime v3 contains a path traversal vulnerability in the compile_program() function within webserver/openplc.py. The function parses FILE directives from uploaded Structured Text (.st) files and writes content to paths constructed with os.path.join('./core', file_path) without validating that the resulting path stays within the ./core directory. An attacker can craft a malicious .st file with directory traversal sequences to write arbitrary content to sensitive filesystem locations such as /etc/cron.d or SSH authorized_keys files, enabling remote code execution. A validate_file_path() function exists in webserver/credentials.py but is never called from compile_program(), leaving the sink unprotected. Compounding the risk, OpenPLC ships with hardcoded default credentials (openplc:openplc), significantly lowering the barrier to exploitation. This vulnerability poses a critical risk especially in industrial control system (ICS/SCADA) environments where OpenPLC is commonly deployed.