The openssl-encrypt package up to version 1.4.8 presents an "Encrypted USB Workspace" that is advertised as using AES‑256‑GCM encryption, yet it stores the workspace directory in cleartext and never applies the derived encryption key. Consequently, any files a user places in the workspace are written to removable media without cryptographic protection, exposing sensitive data to anyone who examines the storage medium.

The vulnerability affects the jahlives:openssl_encrypt Python package (pip package openssl‑encrypt) for all releases through 1.4.8. Versions 1.4.9 and later include a fix that seals the workspace into an authenticated AES‑256‑GCM vault, preventing the storage of unencrypted data.

The CVSS score of 9.3 classifies this flaw as critical, and the EPSS score is not available. It is not listed in CISA’s KEV catalog. The attack requires physical possession of the removable media, after which an attacker can read the unencrypted files. The flaw is easily exploitable for users who trust the branding and are unaware that the data is not encrypted, leading to an unprivileged disclosure of confidential information.