CVE-2026-41082

HIGH

OCaml opam < 2.5.1 - Path Traversal via .install Field

Title source: llm

In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.

Core 7

Core References

Mailing List

Vendor Advisory

Vendor Advisory

Vendor Advisory

CVSS v3 7.3

EPSS 0.0021

EPSS Percentile 10.7%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

CWE

CWE-22 CWE-24

Status published

Products (4)

debian/debian_linux 11.0

OCaml/opam < 2.5.1

ocaml/opam < 2.5.1

redhat/enterprise_linux 10.0

Published Apr 16, 2026

Tracked Since Apr 16, 2026