CVE-2026-81690

Analyzed Analyzed - Analysis Complete

Symlink Following Flaw in openssl-encrypt Package

Publication date: 2026-08-27

Last updated on: 2026-09-02

Assigner: VulnCheck

Description

openssl-encrypt (pip package) before 1.4.9 contains a symlink-following flaw in its verify-usb v2 added-file allowlist scan. The scan enumerated the drive with rglob(), which in CPython does not descend into symlinked directories and treats the symlink as an ordinary directory, while O_NOFOLLOW on the hash side binds only the final path component. An evil-maid attacker with physical access to the removable drive could replace a tool-tree directory with a symlink to a copy containing byte-identical files plus a planted __pycache__/*.pyc file (which CPython loads in preference to recompiling the clean .py). The planted file is never enumerated, added_files stays 0, and verify-usb reports PASSED, resulting in code execution when the victim runs the portable install. Fixed in 1.4.9 (affects both 1.4.x and 1.5.x lines).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-02

Generated

2026-09-17

AI Q&A

2026-08-27

EPSS Evaluated

2026-09-15

NVD

CVE-2026-81690

EUVD

EUVD-2026-67046

Affected Vendors & Products

Vendor	Product	Version / Range
jahlives	openssl_encrypt	to 1.4.9 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-59	The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

Executive Summary

This vulnerability is a symlink directory traversal flaw in the verify-usb component of the openssl-encrypt pip package before version 1.4.9. It allows an attacker with physical access to a removable drive to replace a directory with a symlink pointing to a malicious copy containing identical files and a planted __pycache__/*.pyc file. The scan fails to detect the malicious file because rglob() in CPython does not follow symlinks into directories, while O_NOFOLLOW only binds the final path component. This results in a false PASSED status, leading to code execution when the victim runs the portable install.

Detection Guidance

Check the installed version of the openssl-encrypt package. If it is before 1.4.9, the system is vulnerable. Run: pip show openssl-encrypt or pip list | grep openssl-encrypt to verify the version.

Impact Analysis

If you use the vulnerable openssl-encrypt package before version 1.4.9, an attacker with physical access to your removable drive could plant malicious code that executes when you run the portable install. This could lead to unauthorized code execution on your system, potentially compromising your data or allowing further attacks.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized code execution through physical access to removable drives. If exploited, it may lead to data breaches or unauthorized modifications, violating confidentiality and integrity requirements under these regulations.

Mitigation Strategies

Upgrade the openssl-encrypt package to version 1.4.9 or later immediately. Use: pip install --upgrade openssl-encrypt. Ensure no malicious __pycache__/*.pyc files exist in tool directories on removable drives.

Hi! I’m here to help you understand CVE-2026-81690. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70