CVE-2026-41082

Summary

In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.

Affected Software

Weaknesses

• CWE-24: CWE-24 Path Traversal: '../filedir'

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: partial

Additional References

• https://osv.dev/vulnerability/OSEC-2026-03

CVE Program Container

Additional References

• https://lists.debian.org/debian-lts-announce/2026/04/msg00021.html

ocaml-opam: path traversal via the .install field

Additional References

• https://access.redhat.com/security/cve/CVE-2026-41082
• https://bugzilla.redhat.com/show_bug.cgi?id=2459003
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41082.json

References

• https://github.com/ocaml/opam/releases/tag/2.5.1
• https://github.com/ocaml/opam/pull/6897
• https://osv.dev/vulnerability/OSEC-2026-03

• ←Previous
• Next→