What is CVE-2026-74884?
CVE-2026-74884 is a path traversal vulnerability in the _is_safe_path method of openssl_encrypt versions before 1.4.0. The plugin_id parameter is not sanitized, allowing attackers to inject '../' sequences to escape the plugin config directory. Users are advised to upgrade to version 1.4.0 or later.
Azərbaycanca: CVE-2026-74884, openssl_encrypt modulunun 1.4.0-dan əvvəlki versiyalarında _is_safe_path metodunda path traversal zəifliyidir. plugin_id parametri sanitizə olunmadığı üçün təcavüzkar '../' kimi ardıcıllıqlar daxil edərək plugin konfiqurasiya qovluğu yolundan kənara çıxa bilər. Modulu ən azı 1.4.0 versiyasına yeniləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-22
FAQ2
Which versions of the openssl_encrypt module are affected by CVE-2026-74884?
This path traversal vulnerability affects openssl_encrypt versions before 1.4.0.
How can I protect against CVE-2026-74884?
It is recommended to upgrade the module to version 1.4.0 or later.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.