UNKNOWN PyPI
CVE-2026-74884
PYSEC-2026-3761 · CVE-2026-74884 · GHSA-8jpj-w975-rwv5
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
openssl_encrypt versions before 1.4.0 contain a path traversal vulnerability in the _is_safe_path method where the plugin_id parameter is not sanitized before constructing the plugin config directory path. Attackers can declare a malicious plugin_id containing path traversal sequences like '../' to access arbitrary directories outside the intended plugin directory.
Ready to move
Start Securing
Free, no credit card | First findings in minutes