CVE-2026-81698 — openssl_encrypt before 1.4.9 Shell Injection via info command
openssl_encrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's reconstructed CLI block that interpolates untrusted metadata fields without q…
Published: 2026-08-27 · CVSS: 9.3 · CVSS 4.0
openssl_encrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's reconstructed CLI block that interpolates untrusted metadata fields without quoting. Attackers can craft metadata values like pepper_name containing shell commands that execute when users copy the printed CLI block into a shell.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7