Path Traversal Vulnerability in OpenSSL-Encrypt Plugin by OpenSSL

CVE-2026-81716

What is CVE-2026-81716?

The OpenSSL-Encrypt plugin prior to version 1.4.9 contains a critical flaw that allows for unauthorized file access due to inadequate checks in the PluginSandbox._is_safe_path method. This vulnerability permits a sandboxed plugin, lacking READ_FILES permissions, to read or modify files in another plugin's directory if the directory names share a common prefix. This defect undermines the isolation model intended to keep plugins secure and separate. The issue is resolved in later versions by ensuring that directory matching is stringent, requiring exact matches or inclusion of a trailing path separator to reinforce per-plugin security.

References