The vulnerability allows an attacker to supply a malicious plugin_id containing path‐traversal components such as "../". The plugin configuration directory is constructed without normalizing or sanitizing this input, enabling the attacker to read or manipulate files outside the intended plugin directory. This leads to potential disclosure or modification of arbitrary files, compromising confidentiality and integrity of the affected system.

The affected product is openssl_encrypt released by jahlives. Versions prior to 1.4.0 are vulnerable. Users running any earlier release should consider upgrading immediately.

The CVSS score of 8.7 indicates high severity. No EPSS score is publicly available, so the current exploitation probability is unknown, and the vulnerability is not listed in CISA KEV catalog. The likely attack vector is through any interface that accepts the plugin_id parameter—most likely the plugin registration API—thus an attacker with network access to that interface could trigger the traversal.