---
id: CVE-2026-74883
title: openssl_encrypt before 1.4.0 Sandbox Bypass via pathlib and io
summary: >-
  openssl_encrypt versions before 1.4.0 contain a sandbox bypass vulnerability
  where the plugin sandbox fails to restrict alternative file access methods
  like pathlib.Path and io.open. Attackers can import pathlib or io modules to
  read and…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-693
vendor: jahlives
product: openssl_encrypt
affected:
  - openssl_encrypt < 1.4.0
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-08-17T12:49:10.718690Z'
exploitAvailable: true
published: '2026-08-17'
updated: '2026-10-01'
sourceUpdated: '2026-10-01T15:20:55.999Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74883'
references:
  - url: >-
      https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-mcjj-qw7m-j3cp
    label: GitHub Security Advisory (GHSA-mcjj-qw7m-j3cp)
  - url: >-
      https://www.vulncheck.com/advisories/openssl-encrypt-before-sandbox-bypass-via-pathlib-and-io
    label: >-
      VulnCheck Advisory: openssl_encrypt before 1.4.0 Sandbox Bypass via
      pathlib and io
tags:
  - cve.org
  - exploit-available
  - osv
  - pip
epss: 0.00476
epssPercentile: 0.4095
aliases:
  - PYSEC-2026-3760
  - GHSA-mcjj-qw7m-j3cp
ecosystem: pip
patched:
  - openssl-encrypt 1.4.0
ingestedAt: '2026-09-02T19:31:25.414Z'
---

## Overview

openssl_encrypt versions before 1.4.0 contain a sandbox bypass vulnerability where the plugin sandbox fails to restrict alternative file access methods like pathlib.Path and io.open. Attackers can import pathlib or io modules to read and write arbitrary files, completely bypassing the restricted_open file access controls.

## Affected

- `openssl_encrypt < 1.4.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-74883)

Affected packages:

- `openssl-encrypt < 1.4.0`

Patched in:

- `openssl-encrypt 1.4.0`

Source: https://osv.dev/vulnerability/PYSEC-2026-3760