openssl_encrypt CVE-2026-81701

Exploitation requires the attacker to place a malicious, unsigned plugin file into a top-level plugins/ directory or an unknown plugin subdirectory following the tool's documented installation paths - this is the exact prerequisite named in the description. That in turn requires write access to the plugin directory (local file access, a compromised account, or a supply-chain/social-engineering delivery mechanism) and that the victim subsequently invokes the openssl_encrypt CLI so the plugin loads. What LIMITS exploitation is precisely this plugin-placement requirement: an attacker with no ability to write to the plugin paths cannot trigger the flaw, which contradicts the AV:N/PR:N framing of the published vector and should be confirmed with the vendor. Affected only in versions before 1.4.9.

Signals are partly conflicting and must be weighed carefully. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC/VI/VA:H → 9.3 Critical) models unauthenticated, low-complexity network exploitation with total confidentiality, integrity and availability loss, which is severe on paper. However, the description makes clear that exploitation requires an attacker to PLACE a malicious unsigned plugin into the plugins/ directory following documented installation paths - an action that inherently requires local file-write access or a supply-chain/social-engineering delivery step, which is difficult to reconcile with AV:N/PR:N. This is a real code-execution and key-disclosure issue for anyone who installs untrusted plugins, but the 'remote unauthenticated' framing likely overstates trivial remote reachability - verify the actual delivery path with the vendor. There is no CISA KEV listing and no evidence of a public PoC, so this is a design-level RCE to patch promptly but not an emergency mass-exploitation scenario; EPSS was not provided and no SSVC decision data was supplied.

An attacker crafts a malicious plugin that executes arbitrary code on load and places it in openssl_encrypt's plugins/ directory or an unknown subdirectory - for example by compromising a shared host, tricking a user into installing a 'community' plugin, or via a supply-chain drop. When the victim next runs the CLI, the unsigned plugin loads without signature verification and executes in-process with access to the user's passwords and cryptographic keys. No public PoC has been identified, but low attack complexity means a working exploit would be straightforward to develop.