CVE-2026-74884 describes a path traversal vulnerability in the jahlives openssl_encrypt plugin prior to version 1.4.0. The vulnerability is due to insufficient sanitization of the plugin_id parameter in the _is_safe_path method. An attacker can supply a malicious plugin_id containing '../' sequences to traverse directories and potentially access arbitrary filesystem locations outside the designated plugin config directory.

Successful exploitation could allow an unauthenticated attacker to read or access files outside the intended plugin directory, potentially exposing sensitive information or configuration files. The CVSS 4.0 base score is 8.7 (high severity), reflecting network attack vector, low complexity, no privileges or user interaction required, and high impact on confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor the vendor's announcements for updates. Until a fix is available, avoid using untrusted input for the plugin_id parameter or implement manual input validation to block path traversal sequences.