In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.
Fix
Patch, vendor advisory and mitigation references on NVD 1
- https://github.com/ocaml/opam/pull/6897 Issue Tracking, Patch
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 7.8 · ocaml, debian, redhatNVD modified 2026-10-26 21:10
Affected (CPE criteria) 3
cpe:2.3:a:ocaml:opam:*:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
References 8
- https://github.com/ocaml/opam/pull/6897 Issue Tracking, Patch
- https://github.com/ocaml/opam/releases/tag/2.5.1 Release Notes
- https://osv.dev/vulnerability/OSEC-2026-03 Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2026/04/msg00021.html Mailing List, Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-41082 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2459003 Issue Tracking
- https://osv.dev/vulnerability/OSEC-2026-03 Third Party Advisory
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41082.json Third Party Advisory