HIGHVulnerability

CVE-2026-74884

openssl_encrypt versions before 1.4.0 contain a path traversal vulnerability in the _is_safe_path method where the plugin_id parameter is not sanitized before constructing the plugin config directory path. Attackers can declare a malicious plugin_id containing path traversal sequences like '../' to access arbitrary directories outside the intended plugin directory.

Properties

severity
HIGH
score
7.5
epss_score
0.00266
cve_id
CVE-2026-74884
vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
published_at
2026-08-17T11:16:43.130
last_modified
2026-09-01T15:27:11.257
epss_percentile
0.18211

Related Entities (4)

ENRICHED_BY (1)

[Source]FIRST EPSS

AFFECTS_PRODUCT (1)

[Product]

HAS_WEAKNESS (1)

[Weakness]External Control of File Name or Path

DESCRIBED_BY (1)

[Source]NVD

Explore deeper with Ninja Signal's threat intelligence graph

CVE-2026-74884 — Ninja Signal Threat Intelligence | Ninja Signal