OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Vulnerability

OpenPLC ScadaBR

OpenPLC ScadaBR contains an unrestricted upload of file with dangerous type vulnerability that allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm. Added to CISA KEV on 2025-12-03 (federal deadline 2025-12-24).

First seen: 3 Dec 2025
Last update: 3 Dec 2025, 12:00 UTC
Identifiers: CVE-2021-26828
Source: CISA KEV

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Vulnerability
Severity: high, exploited in the wild. Patch status: patched.
Affected: OpenPLC ScadaBR
Ids: CVE-2021-26828

OpenPLC ScadaBR contains an unrestricted upload of file with dangerous type vulnerability that allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm. Added to CISA KEV on 2025-12-03 (federal deadline 2025-12-24).

## Steps
1. Search the repo, its CI and infra config for OpenPLC ScadaBR. If present, report the version in use and whether it's affected.

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2021-26828") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://nvd.nist.gov/vuln/detail/CVE-2021-26828
https://pwned.coffee/i/openplc-scadabr-unrestricted-upload-of-file-with-dangero-cve-2021-26828

Sources

NVD: CVE-2021-26828

Totalone hot coffee