Path Traversal in openssl_encrypt Plugin Directory Construction

openssl_encrypt versions before 1.4.0 contain a critical path traversal vulnerability in the _is_safe_path method where the plugin_id parameter lacks proper sanitization. When constructing plugin configuration directory paths, attackers can inject path traversal sequences (such as '../') into the plugin_id parameter to escape the intended plugin directory and access arbitrary files on the system. This vulnerability affects any organization deploying vulnerable versions of openssl_encrypt, particularly those using it in multi-tenant environments or where user input influences plugin identification. With a CVSS score of 7.5, the high severity reflects the potential for unauthorized file access, information disclosure, and potential code execution depending on what files exist in traversable directories.

While this CVE currently shows zero matching skills in Casky.ai's 754-skill library mapped to MITRE ATT&CK, practitioners using Claude AI-powered extended reasoning can identify exploitation patterns through behavioral analysis of file system access anomalies. Security teams would detect this attack by monitoring for suspicious directory traversal attempts in application logs, unusual file access patterns outside expected plugin directories, and config file reads from unintended locations. Although no specific MITRE technique mapping exists yet, this vulnerability typically manifests through T1083 (File and Directory Discovery) and T1005 (Data from Local System) as attackers probe and exfiltrate sensitive configuration files. Practitioners should prioritize upgrading to openssl_encrypt 1.4.0 or later and implement input validation rules that reject path traversal sequences in all plugin identifiers.