Most recent entries from all

EUVD-2026-337261

fkie_cve-2026-41082

In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.

GHSA-97q5-qf47-hvrw

In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.

msrc_CVE-2026-41082 — In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.

msrc_CVE-2026-41082

openSUSE-SU-2026:10568-1 — opam-2.5.1-1.1 on GA media

opam-2.5.1-1.1 on GA media

OSEC-2026-03 — opam install sandbox escape

Affected: opam: opam-devel

## Summary

`.install` files do not validate whether they are inside the package area, and so can bypass sandboxing.

## Exploit

In a `package.install` file, this installs a file as ``~/.bashrc`: ``` bin: [ "payload.sh" {"../../../.bashrc"} ] ```

## Timeline

- 2026-04-11: Anil forwarded the issue from Andrew Nesbitt to the OCaml security team - 2026-04-11: Kate developed a fix - 2026-04-15: opam 2.5.1 was released with the fix

UBUNTU-CVE-2026-41082

Affected: Ubuntu:16.04:LTS: opam, Ubuntu:18.04:LTS: opam, Ubuntu:Pro:20.04:LTS: opam, Ubuntu:22.04:LTS: opam, Ubuntu:Pro:24.04:LTS: opam, Ubuntu:25.10: opam, Ubuntu:Pro:26.04:LTS: opam

In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.