CVE Catalog
CVE-2026-41082
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk0.21%
11th percentile - higher than 11% of all known CVEs
Summary
In OCaml opam before version 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.
Risk Assessment
An attacker can place files outside the intended installation directory, potentially overwriting critical system files or escalating privileges.
Recommendation
Immediately update opam to version 2.5.1 or later, which includes a fix preventing the use of ../ in destination filepaths.
Other vulnerabilities in opam
Original NVD description (English source)
In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.