CVEvulnerability
CVE-2026-41082
7.8 HIGH
Official page ↗
- Status
- Analyzed
- Published
- 2026-04-16
- Last modified
- 2026-10-26
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.3 HIGH — CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
- CVSS 3.1 ([email protected])
- 7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS 3.1 (0b0ca135-0b70-47e7-9f44-1890c2a1c46c)
- 7.1 HIGH — CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
- Weaknesses
- CWE-22, CWE-24
Description
In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.
Affected configurations
• ocaml opam (< 2.5.1)
• debian debian linux 11.0
• redhat enterprise linux 10.0
Related
References
- https://github.com/ocaml/opam/pull/6897 Issue Tracking, Patch
- https://github.com/ocaml/opam/releases/tag/2.5.1 Release Notes
- https://osv.dev/vulnerability/OSEC-2026-03 Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2026/04/msg00021.html Mailing List, Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-41082 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2459003 Issue Tracking
- https://osv.dev/vulnerability/OSEC-2026-03 Third Party Advisory
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41082.json Third Party Advisory