EUVD-2026-60103
GHSA-4hf6-j482-f379
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible endpoint with no authentication required; read-only traversal yields high confidentiality impact and no integrity or availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
openssl_encrypt versions before 1.4.0 contain a path traversal vulnerability in the _is_safe_path method where the plugin_id parameter is not sanitized before constructing the plugin config directory path. Attackers can declare a malicious plugin_id containing path traversal sequences like '../' to access arbitrary directories outside the intended plugin directory.
AnalysisAI
Path traversal in the jahlives openssl_encrypt plugin (versions before 1.4.0) permits unauthenticated remote attackers to escape the intended plugin configuration directory by supplying crafted plugin_id values containing sequences such as '../'. The _is_safe_path method fails to sanitize the plugin_id parameter before using it to construct filesystem paths, exposing arbitrary server-side files readable by the application process. No active exploitation is confirmed (not in CISA KEV) and no public POC has been identified at time of analysis, though the network-accessible, zero-authentication attack profile makes this straightforward to exploit from the vulnerability description alone.
Technical ContextAI
CWE-73 (External Control of File Name or Path) describes the root cause: user-supplied input is used directly or insufficiently filtered when constructing a filesystem path, allowing an attacker to resolve paths outside the intended directory boundary. The affected component is the _is_safe_path method in the jahlives openssl_encrypt plugin - a third-party PHP plugin (CPE: cpe:2.3:a:jahlives:openssl_encrypt) - which is responsible for validating that a plugin_id maps to a safe config directory. Because path traversal sequences like '../' are not stripped or rejected, the constructed path can walk up the directory tree to reach sensitive system or application files. This is not the OpenSSL cryptographic library; it is an independently developed plugin by the 'jahlives' author.
RemediationAI
Upgrade openssl_encrypt to version 1.4.0 or later, where the _is_safe_path method has been corrected to sanitize the plugin_id parameter. The fix is confirmed by the vendor via the GitHub Security Advisory at https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-8jpj-w975-rwv5 and detailed further at https://www.vulncheck.com/advisories/openssl-encrypt-before-path-traversal-via-plugin-id. If immediate upgrade is not feasible, restrict network access at the perimeter or WAF level to any endpoint that accepts the plugin_id parameter, specifically blocking requests where plugin_id contains '../', '..\', or absolute path prefixes such as '/'. Alternatively, add server-side input validation upstream of the plugin to reject traversal sequences before they reach _is_safe_path - note that allowlist-based validation (permitting only alphanumeric plugin IDs) is more reliable than denylist-based filtering, which is prone to encoding bypass.
More in Openssl Encrypt
View allArbitrary native code execution in the jahlives openssl_encrypt Python package (all versions before 1.4.0) arises from i
Fingerprint-verification spoofing in jahlives openssl_encrypt before 1.4.9 lets attackers embed ANSI escape sequences in
Sandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 allows attacker-supplied plugins to run wit
Arbitrary code execution in jahlives openssl_encrypt before 1.4.0 stems from an inconsistent sandbox: the runtime Plugin
Authentication bypass in the jahlives openssl_encrypt library (all versions before 1.4.0) lets remote unauthenticated at
Authentication brute-force protection can be bypassed in jahlives openssl_encrypt before 1.4.0 because the TOTP rate lim
Sandbox escape in the openssl_encrypt Python library (jahlives) before 1.4.0 lets attacker-supplied plugin code break ou
Cryptographic shared-secret disclosure in the openssl_encrypt Python library (maintainer 'jahlives') before 1.4.0 lets a
Sandbox escape leading to remote code execution affects openssl_encrypt (the jahlives Python package) in all versions be
Arbitrary code execution in openssl_encrypt (the jahlives Python encryption utility) before 1.4.9 allows an attacker-sup
Arbitrary code execution in jahlives openssl_encrypt before 1.4.9 stems from a flawed plugin trust model that uses a den
Sensitive-token exposure in openssl_encrypt (the jahlives Python package, pip 'openssl-encrypt') before 1.4.0 stems from
Same weakness CWE-73 – External Control of File Name or Path
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today