CVE-2026-74884 jahlives CVE debrief

Who should care

Administrators and security teams responsible for openssl_encrypt installations, particularly in environments where plugin_id handling is critical, should be aware of this vulnerability and take immediate action to mitigate it. This includes identifying and patching or mitigating affected systems as soon as possible. The vulnerability's HIGH CVSS score of 8.7 indicates a high level of severity, and affected systems should be prioritized for remediation.

Technical summary

The _is_safe_path method in openssl_encrypt versions before 1.4.0 does not properly sanitize the plugin_id parameter, allowing attackers to construct arbitrary directory paths using '../' sequences. This vulnerability has a CVSS score of 8.7 and is classified as HIGH severity. The vulnerability affects openssl_encrypt installations, particularly in environments where plugin_id handling is critical. Administrators and security teams should be aware of this vulnerability and take immediate action to mitigate it.

Defensive priority

High-priority defensive actions are required due to the HIGH CVSS score of 8.7. Affected systems should be identified and patched or mitigated as soon as possible.

Recommended defensive actions

• Inventory and assess openssl_encrypt installations to identify potentially vulnerable versions.
• Upgrade to version 1.4.0 or later to mitigate the vulnerability.
• Implement additional monitoring and logging to detect potential exploitation attempts.
• Review and update security policies to ensure secure plugin_id handling.
• Consider compensating controls, such as web application firewalls, to detect and prevent exploitation.

Evidence notes

The evidence from the NVD and CVE Program records indicates a path traversal vulnerability in openssl_encrypt versions before 1.4.0. The _is_safe_path method does not sanitize the plugin_id parameter, allowing attackers to access arbitrary directories. This vulnerability has a CVSS score of 8.7 and is classified as HIGH severity. The NVD entry is currently Analyzed. Further verification by defenders is recommended to assess the impact on their specific environments.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.