Arbitrary File Upload in OpenPLC Runtime /edit-user

An authenticated attacker can upload arbitrary files and cause them to be hosted by the OpenPLC webserver under /static. This can enable unauthorized content hosting, stored client-side script execution if active content is rendered by a victim's browser, phishing or UI redressing using attacker-controlled pages, and potential compromise of users who access the uploaded content. The available information does not establish server-side code execution, so impact should be limited to arbitrary file hosting and any downstream client-side effects of serving attacker-controlled files.

If an immediate fix is not available, restrict access to /edit-user to only trusted administrative users, disable or firewall external access to the management interface, and monitor for unexpected files under the /static path. As a compensating control, block serving of user-uploaded active content types such as .html, .svg, and other script-capable formats, and place reverse-proxy or webserver rules in front of OpenPLC to deny requests for suspicious uploaded content. Review authentication exposure and remove unnecessary accounts to reduce the set of users able to exploit the issue.

Upgrade OpenPLC Runtime to a version in which /edit-user properly restricts uploaded content and prevents user-supplied files from being published directly under a web-accessible static directory. Remediation should include strict server-side allowlisting of permitted file types, validation of file content rather than relying only on extensions, storage of uploads outside the web root, generation of safe server-side filenames, and denial of active content types such as .html and .svg where not explicitly required.