CVE-2026-74884 describes a path traversal vulnerability in the jahlives openssl_encrypt plugin versions prior to 1.4.0. The vulnerability occurs in the _is_safe_path method where the plugin_id parameter is used without proper sanitization when constructing the plugin configuration directory path. This allows an attacker to supply a malicious plugin_id containing sequences like '../' to traverse directories and potentially access arbitrary filesystem locations outside the intended plugin directory.

An attacker can exploit this vulnerability to access arbitrary directories on the filesystem outside the intended plugin directory. This could lead to unauthorized disclosure of sensitive files or configuration data. The CVSS 4.0 score is 8.7 (high severity), indicating a network exploitable vulnerability with no required privileges or user interaction and high impact on confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid using untrusted input for the plugin_id parameter or apply manual input validation to prevent path traversal sequences.