An unauthenticated path traversal vulnerability in the jahlives openssl_encrypt library allows remote attackers to access sensitive files on the host system.

This vulnerability is caused by improper handling of file paths, categorized as CWE-73 (External Control of File Name or Path). It allows an unauthenticated remote attacker to perform unauthorized file access operations.

Successful exploitation of this vulnerability could lead to the exposure of sensitive system configuration files or application data. Given the CVSS score of 7.5, this high-severity flaw poses a significant risk to data confidentiality, potentially enabling further system compromise or credential theft.

Immediate Action: Update the jahlives openssl_encrypt library to version 1.4.0 or later to resolve this vulnerability.

Proactive Monitoring: Inspect application logs for unusual file path patterns or attempts to access restricted directories outside of the intended scope.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block directory traversal sequences, such as dot-dot-slash patterns.

Public Exploit Available: No

The vulnerability represents a significant risk to confidentiality and should be addressed immediately. Administrators must prioritize updating the openssl_encrypt dependency to version 1.4.0 across all environments to eliminate the path traversal risk.