CVE-2026-81690

Name of the Vulnerable Software and Affected Versions openssl-encrypt versions prior to 1.4.9

Description A symlink-following flaw exists in the verify-usb v2 added-file allowlist scan. The scan uses the rglob() function, which in CPython does not descend into symlinked directories and treats the symlink as an ordinary directory. Meanwhile, O NOFOLLOW on the hash side only binds the final path component. An attacker with physical access to a removable drive could replace a tool-tree directory with a symlink to a copy containing byte-identical files and a planted pycache /*.pyc file. Since CPython loads these compiled files in preference to recompiling the clean .py files, and the planted file is not enumerated during the scan, the added files variable remains 0. This causes verify-usb to report a PASSED status, leading to code execution when the victim runs the portable install.

Recommendations Update to version 1.4.9.