CVE-2026-41082

In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory...

CVE-2026-41082

In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory...

CVE-2026-41082

In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory...

CVE-2026-41082

OCaml opam before 2.5.1 is affected: a .install field containing a destination filepath can traverse to a parent directory via ../, enabling potential path traversal. The issue is fixed in opam 2.5.1 (see OCaml/opam release 2.5.1). Affected component: opam’s packaging/install logic; root cause: i...

CVE-2026-41082

In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory...

CVE-2026-41082

In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory...

devel/ocaml-opam -- CWE-24 Path Traversal: '../filedir'

https://github.com/ocaml/opam/releases/tag/2.5.1 reports: In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory. Reported by Andrew Nesbitt...

OSEC-2026-03 opam install sandbox escape

Summary .install files do not validate whether they are inside the package area, and so can bypass sandboxing. Exploit In a package.install file, this installs a file as /.bashrc: bin: "payload.sh" "../../../.bashrc" Timeline - 2026-04-11: Anil forwarded the issue from Andrew Nesbitt to the OCaml...

PT-2026-33355

Name of the Vulnerable Software and Affected Versions opam versions prior to 2.5.1 Description A directory traversal issue exists where a .install field containing a destination filepath can use ../ to reach a parent directory. Recommendations Update to version 2.5.1...

security-advisories

OCaml Security Advisory Database The OCaml Security Advisory...

OSEC-2023-01 Time of check time of use issue in opam's cache

Bug description Opam uses since version 2.0.0 a download cache: if a source artifact is needed, first its hash is looked up in the local cache /.opam/download-cache//. Opam supports multiple hash algorithms, a cache lookup tries all hash algorithms present in the opam file. Before opam 2.1.5, the...