CVE-2021-26828: OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Vulnerability

High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2025-12-03. EPSS: 39.4% chance of exploitation in the next 30 days.

OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm.

Affected products

• ScadaBR ScadaBR: up to and including 0.9.1; up to and including 1.12.4

Published 2021-06-11. Last modified 2026-06-17.