CVE-2026-74883: openssl_encrypt before 1.4.0 Sandbox Bypass via pathlib and io

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-08-17 · updated 2026-09-01
Weakness: CWE-693

Description

openssl_encrypt versions before 1.4.0 contain a sandbox bypass vulnerability where the plugin sandbox fails to restrict alternative file access methods like pathlib.Path and io.open. Attackers can import pathlib or io modules to read and write arbitrary files, completely bypassing the restricted_open file access controls.

Affected products

jahlives openssl_encrypt: before 1.4.0 — fixed in 1.4.0

How to fix

Upgrade to a fixed version: jahlives openssl_encrypt 1.4.0. Check the vendor advisory for mitigations.

References

https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-mcjj-qw7m-j3cp
https://www.vulncheck.com/advisories/openssl-encrypt-before-sandbox-bypass-via-pathlib-and-io
https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-mcjj-qw7m-j3cp

Get alerted when CVE-2026-74883 or the next vulnerability affects your stack