CVE-2026-74884 in openssl_encrypt
Summary
by MITRE • 08/17/2026
openssl_encrypt versions before 1.4.0 contain a path traversal vulnerability in the _is_safe_path method where the plugin_id parameter is not sanitized before constructing the plugin config directory path. Attackers can declare a malicious plugin_id containing path traversal sequences like '../' to access arbitrary directories outside the intended plugin directory.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/17/2026
The identified security flaw resides within the openssl_encrypt library, specifically affecting versions prior to 1.4.0, and centers on an improper input validation mechanism in the _is_safe_path method. This function is responsible for verifying that a requested file path remains confined within a designated directory structure, thereby preventing unauthorized access to system files outside of the application's intended scope. The core technical deficiency lies in the failure to properly sanitize or canonicalize the plugin_id parameter before it is concatenated with other path components to construct the full path to the plugin configuration directory. By neglecting to resolve relative path sequences such as dot-dot-slash (../) during this validation phase, the application allows an attacker to manipulate the resulting file system navigation sequence. This oversight effectively bypasses the intended boundary controls that are supposed to restrict access strictly to the plugins folder.
From a technical perspective, this vulnerability is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory. The absence of robust path normalization means that when an attacker supplies a plugin_id containing traversal sequences like ../, these characters are interpreted literally by the underlying file system operations rather than being stripped or resolved against the base directory. Consequently, the application attempts to load configuration files from arbitrary locations on the host operating system. This behavior creates a classic Path Traversal scenario where the integrity of the access control model is compromised because the validation logic does not account for relative path manipulation techniques that are standard in file inclusion attacks.
The operational impact of this vulnerability can be severe, depending on the privileges under which the application runs and the sensitivity of files accessible via the web server or backend process. An attacker could potentially read sensitive configuration files containing database credentials, API keys, or internal network topology details stored outside the plugin directory. In more critical scenarios, if the application allows for file inclusion in a way that leads to code execution, this path traversal could serve as an initial vector for Remote Code Execution (RCE). Even without direct code execution, the ability to read arbitrary files constitutes a significant confidentiality breach and can facilitate further reconnaissance or privilege escalation within the compromised environment. This aligns with ATT&CK technique T1083: File and Directory Discovery, where adversaries use discovered file paths to locate sensitive data for exfiltration or further exploitation.
To mitigate this vulnerability, immediate action is required by upgrading the openssl_encrypt library to version 1.4.0 or later, which presumably includes fixes for input sanitization in the _is_safe_path method. In cases where an upgrade is not immediately feasible, a temporary workaround involves implementing strict allow-listing of characters permitted in the plugin_id parameter and ensuring that all path inputs are canonicalized before use. Developers should utilize standard library functions to resolve absolute paths and verify that the resulting resolved path still begins with the expected base directory prefix. Additionally, applying principle of least privilege by running the application process with minimal file system permissions can reduce the blast radius if an attacker successfully exploits this flaw. Regular security audits focusing on input validation for all dynamic file path constructions are recommended to prevent similar issues in other parts of the codebase.