CVE-2026-74884: openssl_encrypt before 1.4.0 Path Traversal via plugin_id
opensslencrypt versions before 1.4.0 contain a path traversal vulnerability in the issafepath method where the pluginid parameter is not sanitized before constructing the plugin config directory path. Attackers can declare a malicious pluginid containing path traversal sequences like '../' to access arbitrary directories outside the intended plugin directory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openssl_encryptto a version that resolves this vulnerability.Fixed in 1.4.0 - Compensating control
If you cannot upgrade immediately, validate/sanitize the plugin_id input to remove path traversal sequences such as '../' before it is used to construct any plugin config directory paths.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74884?
The severity of CVE-2026-74884 is high with a CVSS score of 7.5.
How do I fix CVE-2026-74884?
To fix CVE-2026-74884, upgrade to OpenSSL Encrypt version 1.4.0 or later.
What kind of vulnerability is CVE-2026-74884?
CVE-2026-74884 is a path traversal vulnerability affecting OpenSSL Encrypt.
What damage can CVE-2026-74884 cause?
CVE-2026-74884 can allow attackers to bypass security mechanisms by manipulating the plugin_id parameter.
Who is affected by CVE-2026-74884?
CVE-2026-74884 affects users of OpenSSL Encrypt versions prior to 1.4.0.