CVE-2026-74884 is a path traversal in the openssl_encrypt plugin where the plugin_id parameter gets concatenated into filesystem paths without validation. But calling this a 'missing sanitization' issue misses the point. The real failure is API design: a parameter named 'plugin_id' carries no inherent implication that it maps to filesystem paths, yet the implementation silently treats it as one. Developers integrating this method would have no obvious cue that they were responsible for escaping '../' sequences.
The vulnerability exists not because a developer forgot to sanitize, but because the API made sanitization invisible as a requirement. This is a pattern failure, not an isolated bug. The same genetic sequence—identifier parameter silently concatenated into filesystem operations—appears across CVEs with minor variations. Each time, the narrative is identical: internal-only assumption, later exposure to untrusted input, path traversal follows.
When assessing this vulnerability in your environment, do three things. First, determine what the openssl_encrypt plugin's process can actually reach—what configuration files, credentials, or activation scripts exist in its filesystem context. A path traversal that can reach database credentials is severity 8+; one limited to world-readable logs is far lower. The CVSS 7.5 rating reflects theoretical worst case, not necessarily what your deployment exposes. Second, examine whether the patch—restricting plugin_id to alphanumeric characters—is actually deployed, and understand that this allowlist approach creates fragility: every future requirement for hyphens, namespaces, or versioned identifiers will pressure this restriction toward relaxation. Third, audit your plugin ecosystem for other methods where identifier parameters silently become path components without validation. The openssl_encrypt plugin was likely stable, unmaintained code—the exact context where trust boundaries quietly rot while nobody is watching. The fix addresses this instance; the architectural conflation of identity with location may persist elsewhere.