CVE-2026-81682: openssl_encrypt before 1.4.9 Insecure File Permissions
opensslencrypt versions before 1.4.9 contain an insecure file permissions vulnerability in the desktop GUI that writes decrypted plaintext with world-readable default permissions. Attackers can read decrypted output files created by the GUI as unprivileged local users on multi-user systems.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openssl_encryptto a version that resolves this vulnerability.Fixed in 1.4.9 - Upgrade
Upgrade
openssl_encryptto a version that resolves this vulnerability.Fixed in 1.4.9Patch Insecure File Permissions
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Users of the desktop GUI on multi-user systems are exposed when it creates decrypted output files. Other unprivileged local users may be able to read those plaintext files.
What access does an attacker need to exploit it?
An attacker needs local access as an unprivileged user on the same system and access to the decrypted output files created by the GUI. No privileges or user interaction are required.
Are command-line or other non-GUI workflows affected?
The available information identifies the desktop GUI as the affected component. It does not state that command-line or other workflows create files with the insecure default permissions.
What version should be used to avoid the issue?
The issue affects versions before 1.4.9. Use version 1.4.9 or later.