Description

openssl_encrypt versions before 1.4.0 contain a path traversal vulnerability in the _is_safe_path method where the plugin_id parameter is not sanitized before constructing the plugin config directory path. Attackers can declare a malicious plugin_id containing path traversal sequences like '../' to access arbitrary directories outside the intended plugin directory.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-17T11:16:43.130Z",
  "pubdate": "2026-08-17T11:16:43.130Z",
  "executiveSummary": "A path traversal vulnerability exists in openssl_encrypt versions prior to 1.4.0, specifically within the _is_safe_path method.\nThe vulnerability arises due to a failure to sanitize the plugin_id parameter prior to utilizing it in the construction of the plugin configuration directory path.\nSuccessful exploitation of this security flaw allows an authenticated or suitably positioned attacker to supply a malicious plugin_id containing directory traversal sequences such as '../'.\nThis capability enables unauthorized traversal outside the intended plugin directory structure, granting the attacker the ability to access arbitrary files and directories on the underlying host system.\nThe risk implication is significant as it compromises filesystem integrity and confidentiality, potentially exposing sensitive system or application data.\nAttackers require the capability to interact with the vulnerable application interface and supply input to the plugin_id parameter to successfully execute the path traversal payload.",
  "technicalDetails": "The vulnerability is rooted in inadequate input validation and sanitization within the _is_safe_path method of openssl_encrypt versions prior to 1.4.0.\nThe vulnerable component fails to properly inspect, filter, or neutralize relative path characters, specifically dot-dot-slash sequences ('../'), present within the plugin_id parameter.\nWhen the application processes the unsanitized plugin_id parameter to construct the file system path for the plugin configuration directory, the underlying operating system resolves the traversal sequences.\nThe step-by-step attack flow begins when an attacker crafts a malicious input string for the plugin_id parameter containing multiple path traversal sequences.\nThe application accepts this payload without validation and concatenates it directly into the base plugin directory path string.\nUpon attempting to access or configure the plugin directory using the constructed path, the file system evaluates the traversal sequences and resolves the target location to a parent directory outside the intended security boundary.\nThis permits the attacker to bypass access controls and interact with arbitrary directories and potentially sensitive files that reside outside the designated storage scope.\nThe technical impact includes unauthorized file system access, potential exposure of sensitive configuration or system data, and violation of the principle of least privilege within the application architecture."
}