CVE search · CVE-2026-41082

CVE-2026-41082

high 7.8

In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.

Open in the NVD CVE.org JSON

Status: Analyzed
Published: 2026-04-16
Last changed: 2026-10-26
Source: cve@mitre.org
Weakness: CWE-24, CWE-22

Severity

Version	Score	Vector	Source
CVSS 3.1	high 7.3	`CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L`	cve@mitre.orgSecondary
CVSS 3.1	high 7.8	`CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`	nvd@nist.govPrimary
CVSS 3.1	high 7.1	`CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H`	0b0ca135-0b70-47e7-9f44-1890c2a1c46cSecondary

Affected products

Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.

ocaml · opam
debian · debian_linux
redhat · enterprise_linux

References

https://github.com/ocaml/opam/pull/6897Issue TrackingPatch
https://github.com/ocaml/opam/releases/tag/2.5.1Release Notes
https://osv.dev/vulnerability/OSEC-2026-03Third Party Advisory
https://lists.debian.org/debian-lts-announce/2026/04/msg00021.htmlMailing ListThird Party Advisory
https://access.redhat.com/security/cve/CVE-2026-41082Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2459003Issue Tracking
https://osv.dev/vulnerability/OSEC-2026-03Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41082.jsonThird Party Advisory