Description

openssl_encrypt versions before 1.4.9 contain an insecure file permissions vulnerability in the desktop GUI that writes decrypted plaintext with world-readable default permissions. Attackers can read decrypted output files created by the GUI as unprivileged local users on multi-user systems.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.2",
  "pubDate": "2026-08-27T17:20:57.660Z",
  "pubdate": "2026-08-27T17:20:57.660Z",
  "executiveSummary": "The openssl_encrypt application is affected by an insecure file permissions vulnerability within its desktop GUI component, impacting versions prior to 1.4.9.\nThe vulnerability occurs because decrypted plaintext files are generated with overly permissive file system access controls, specifically granting read access to all system users.\nThis flaw enables unauthorized local users on multi-user systems to access sensitive decrypted data without requiring administrative privileges.\nThe risk implication is significant as it facilitates unauthorized data exposure and potential loss of confidentiality for users handling sensitive information.\nExploitation requires the attacker to have unprivileged local access to the target host system and the ability to monitor the filesystem for the creation of decrypted output files.\nThere are no requirements for network exposure or complex authentication bypasses, as the vulnerability is inherent to the local file system object creation process within the desktop GUI.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling of file creation flags during the decryption process within the openssl_encrypt desktop GUI. Specifically, the application fails to explicitly define restrictive permissions when calling system-level file creation APIs. Consequently, the operating system applies default umask settings which, in many multi-user environments, result in world-readable file permissions (e.g., 644 or similar modes) for the resulting plaintext output.\nIn a typical attack flow, the legitimate user interacts with the openssl_encrypt GUI to decrypt a sensitive file. The GUI process invokes a decryption function that writes the resulting plaintext to a temporary or designated output directory. Due to the lack of secure file descriptor initialization or subsequent 'chmod' operations to restrict access, the file is created with permissive access control lists (ACLs) or POSIX permissions.\nAn unprivileged local attacker can exploit this condition by monitoring the target directory for the creation of decrypted output files. Because the files are world-readable, the attacker can access the filesystem path as soon as the file is committed to disk, facilitating the unauthorized retrieval of the decrypted content. This process does not require the attacker to influence the decryption process or bypass cryptographic protections, as the vulnerability resides entirely in the post-decryption file handling mechanism.\nThe affected component is the desktop GUI implementation of openssl_encrypt. This vulnerability is restricted to local exploitation, requiring the attacker to possess a local account on the host machine. No network exposure is necessary to conduct the attack, as the primary vector is the local file system structure. Post-exploitation impact involves the total compromise of confidentiality for any decrypted material saved to disk by the vulnerable GUI, effectively circumventing the security intended by the encryption process.\nThe scope of the vulnerability includes all versions prior to 1.4.9. The implementation failed to adopt secure coding practices regarding file permission masks, such as utilizing 'umask' to ensure that new files are created only with owner-read/write permissions (e.g., 600). The failure to implement these restrictive settings during the file creation system call represents a significant security oversight in the application's desktop integration."
}