CVE-2026-81716

openssl_encrypt before 1.4.9 Plugin Sandbox Path Traversal

8.7 HighFix available

openssl_encrypt (pip: openssl-encrypt) versions before 1.4.9 contain a path traversal flaw in PluginSandbox._is_safe_path, which authorized file access using a bare string-prefix match. A sandboxed plugin without the READ_FILES permission could read or write another plugin's directory that merely shares a name prefix (e.g., .../plugins/foobar matching allowed .../plugins/foo), breaking per-plugin isolation within the same user. Fixed by matching each allowed directory exactly or with a trailing path separator.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.26%Up 0.1 points since Aug 28, 2026

What each source reports

CVE List Score used 8.7

openssl_encrypt before 1.4.9 Plugin Sandbox Path Traversal

Record: CVE-2026-81716
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 5.2 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Weakness: CWE-22
Updated: 2026-11-02

EUVDEUVD-2026-67066 8.7

Record: EUVD-2026-67066
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-7qxw-7jv4-3qr8 8.7

openssl_encrypt (pip: openssl-encrypt) versions before 1.4.9 contain a path traversal flaw in...

Record: GHSA-7qxw-7jv4-3qr8
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 5.2 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Weakness: CWE-22
Updated: 2026-11-02

NVD 8.7

Record: CVE-2026-81716
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 5.2 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Weakness: CWE-22
Updated: 2026-11-02

OSV 8.7

openssl_encrypt before 1.4.9 Plugin Sandbox Path Traversal

Record: CVE-2026-81716
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-22
Updated: 2026-11-02

OSVPYSEC-2026-3800 8.7

Record: PYSEC-2026-3800
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated: 2026-11-02

Affected products

jahlives openssl encrypt

Affected packages

Affected packages
Package	Affected	Fixed
`openssl-encrypt` PyPI	before 1.4.9, plus listed versions 0.2.20.2.30.2.40.2.50.2.6 Show 45 moreShow less 0.3.00.3.10.3.20.3.30.4.00.4.10.4.20.4.30.4.40.5.00.5.10.5.30.6.0rc10.7.0rc20.7.10.7.20.8.00.8.10.8.20.9.21.0.01.0.11.0.21.0.31.1.01.2.01.2.11.3.01.3.11.3.21.3.31.3.41.3.51.4.01.4.0b31.4.0b41.4.0b51.4.0b61.4.0b71.4.0b81.4.11.4.1rc21.4.21.4.41.4.5	1.4.9

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-81716 is a high vulnerability (CVSS 8.7) in Jahlives Openssl Encrypt, published August 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.26%, the 17th percentile. Fixed in openssl-encrypt 1.4.9.

References

This page doesn't list everything

Left out here: 3 versions. The JSON record has them.