CVE-2026-41082

Description

In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.

PUBLISHED Reserved 2026-04-16 | Published 2026-04-16 | Updated 2026-04-21 | Assigner mitre

Problem types

CWE-24 Path Traversal: '../filedir'

Product status

References

lists.debian.org/debian-lts-announce/2026/04/msg00021.html

github.com/ocaml/opam/releases/tag/2.5.1

github.com/ocaml/opam/pull/6897

cve.org (CVE-2026-41082)

nvd.nist.gov (CVE-2026-41082)

Download JSON