Description
openssl_encrypt versions before 1.4.9 contain an insecure file permissions vulnerability in the desktop GUI that writes decrypted plaintext with world-readable default permissions. Attackers can read decrypted output files created by the GUI as unprivileged local users on multi-user systems.
Published: 2026-08-27
Score: 8.6 High
EPSS: < 1% Very Low
KEV: No
Impact: Confidentiality breach
Action: Immediate Patch
AI Analysis

Impact

This vulnerability exists in openssl_encrypt versions before 1.4.9. The desktop GUI writes decrypted plaintext files with insecure default file permissions, allowing any local user on a multi‑user system to read the decrypted output. The weakness is an Insecure Permissions issue (CWE‑276) that can result in a confidentiality breach of data that was intended to remain protected after decryption.

Affected Systems

Installations of the jahlives OpenSSL Encrypt application running any version older than 1.4.9 are affected. The issue is confined to the desktop GUI component that writes decrypted files to the file system.

Risk and Exploitability

The CVSS score of 8.6 classifies the vulnerability as High severity. No EPSS score is publicly reported, and the vulnerability is not listed in the CISA KEV catalog. Attackers must have local, unprivileged access and the ability to launch the GUI; once the GUI creates a decrypted file, its world‑readable permissions permit any local user to read the file’s contents.

Generated by OpenCVE AI on August 27, 2026 at 18:09 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade openssl_encrypt to version 1.4.9 or later
  • Ensure that the application creates decrypted files with secure default permissions
  • If upgrading is delayed, restrict file system permissions on the directory where decrypted files are stored to prevent read access by other users

Generated by OpenCVE AI on August 27, 2026 at 18:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 01 Sep 2026 07:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 27 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
First Time appeared Jahlives
Jahlives openssl Encrypt
Vendors & Products Jahlives
Jahlives openssl Encrypt

Thu, 27 Aug 2026 16:45:00 +0000

Type Values Removed Values Added
Description openssl_encrypt versions before 1.4.9 contain an insecure file permissions vulnerability in the desktop GUI that writes decrypted plaintext with world-readable default permissions. Attackers can read decrypted output files created by the GUI as unprivileged local users on multi-user systems.
Title openssl_encrypt before 1.4.9 Insecure File Permissions
Weaknesses CWE-276
References
Metrics cvssV3_1

{'score': 6.2, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Jahlives Openssl Encrypt
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-31T15:56:14.467Z

Reserved: 2026-08-27T11:11:30.934Z

Link: CVE-2026-81682

cve-icon Vulnrichment

Updated: 2026-08-31T15:56:09.841Z

cve-icon NVD

Status : Received

Published: 2026-08-27T17:20:57.660

Modified: 2026-08-31T16:19:15.853

Link: CVE-2026-81682

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-27T20:15:03Z

Weaknesses
  • CWE-276

    Incorrect Default Permissions