SZB-a1fd302409
EUVD-2026-67050: unsanitized filenames in openssl-encrypt verify-usb output
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- openssl-encrypt
- Product
- openssl_encrypt
- First seen
Summary
The EUVD entry, scored 9.3 under CVSS v3.1, describes a flaw in the openssl-encrypt pip package, versions 1.4.8 and earlier. The entry says filenames read from untrusted drive data are printed without sanitization by the verify-usb command.
If you use openssl-encrypt
Upgrade the openssl-encrypt pip package beyond 1.4.8
Avoid running verify-usb on untrusted drives until patched
Treat terminal output from verify-usb as untrusted
What the sources say 1
· Mastodon: “openssl-encrypt (pip package, versions <= 1.4.8) fails to sanitize filenames read from untrusted drive data (outside the AES-GCM authenticated manifest) before printing them in the verify-usb command's output.” Source