CVE-2026-74883: openssl_encrypt before 1.4.0 Sandbox Bypass via pathlib and io
opensslencrypt versions before 1.4.0 contain a sandbox bypass vulnerability where the plugin sandbox fails to restrict alternative file access methods like pathlib.Path and io.open. Attackers can import pathlib or io modules to read and write arbitrary files, completely bypassing the restrictedopen file access controls.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openssl_encryptto a version that resolves this vulnerability.Fixed in 1.4.0 - Compensating control
Until upgraded, prevent untrusted users from using or controlling any functionality that would allow importing or using pathlib.Path or io.open to read/write files, since restricted_open controls can be bypassed via these modules in openssl_encrypt versions before 1.4.0.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74883?
CVE-2026-74883 has a high severity rating of 8.8.
How do I fix CVE-2026-74883?
To fix CVE-2026-74883, update to OpenSSL openssl_encrypt version 1.4.0 or later.
What types of attacks are possible with CVE-2026-74883?
CVE-2026-74883 allows attackers to bypass the sandbox and access arbitrary files using pathlib or io modules.
Which versions of OpenSSL are affected by CVE-2026-74883?
CVE-2026-74883 affects OpenSSL openssl_encrypt versions prior to 1.4.0.
What components are impacted by CVE-2026-74883?
CVE-2026-74883 impacts the sandbox functionality in the openssl_encrypt plugin.