CVE-2026-81716: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in jahlives openssl_encrypt

The vulnerability in openssl_encrypt (pip package) versions before 1.4.9 arises from improper limitation of pathname access in PluginSandbox._is_safe_path. The method authorized file access based on a simple string-prefix match, allowing unauthorized read/write access to directories of other plugins with similar name prefixes. This breaks the intended per-plugin isolation within the same user context. The fix involves changing the path validation logic to match allowed directories exactly or with a trailing path separator to prevent prefix-based bypass.

An attacker controlling a sandboxed plugin without READ_FILES permission can read or write files in other plugins' directories if those directories share a name prefix. This compromises the isolation between plugins, potentially leading to unauthorized data access or modification within the same user environment. The vulnerability has a high severity with a CVSS 4.0 score of 8.7, indicating it is remotely exploitable without privileges or user interaction and results in high confidentiality impact.

A fix is available in openssl_encrypt version 1.4.9 that corrects the path validation logic to prevent path traversal via prefix matching. Users should upgrade to version 1.4.9 or later to remediate this vulnerability. No vendor advisory content was provided, so check the official project repository or vendor channels for the patch and further guidance.