CVE-2026-57825
In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed...
In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files.
- Record
CVE-2026-57825- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N - Weakness
- CWE-61
- Updated
- 2026-11-02
EUVDEUVD-2026-74594
In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files.
- Record
EUVD-2026-74594- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-rwq5-7hr3-r2qf
In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed...
In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files.
- Record
GHSA-rwq5-7hr3-r2qf- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N - Weakness
- CWE-61
- Updated
- 2026-11-02
NVD
In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files.
- Record
CVE-2026-57825- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N - Weakness
- CWE-61
- Updated
- 2026-11-02
OSVALPINE-CVE-2026-57825
In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files.
- Record
ALPINE-CVE-2026-57825- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-03
OSV
In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files.
- Record
CVE-2026-57825- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N - Weakness
- CWE-61
- Updated
- 2026-11-02
Show 5 moreShow less
OSVDEBIAN-CVE-2026-57825
In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files.
- Record
DEBIAN-CVE-2026-57825- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVOSEC-2026-10
opam install sandbox escape using symlinks
Summary
Installing files through .install files do not check symlinks resolution of the target path, and so can bypass sandboxing.
Exploit
Let's imagine a test package whose test.install file looks like the following:
share_root: [
"test" {"blah/pwnd"}
]
and test.opam file:
opam-version: "2.0"
install: ["sh" "-c" "ln -s \"$HOME\" \"%{share}%/blah\""]
Installing this package will write the pwnd file in the home directory of the current user, bypassing sandboxing.
Timeline
- 2026-05-15: Kate reported the issue to the rest of the opam team and the OCaml Security team
- 2026-06-22: Nathan wrote a fix which was then reviewed by Raja and refined over the next 2 weeks
- 2026-07-08: opam 2.5.2 was released with the fix
- Record
OSEC-2026-10- CVSS 3.0
- 5.7 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-06
OSVUBUNTU-CVE-2026-57825
In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files.
- Record
UBUNTU-CVE-2026-57825- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11296-1 No score
opam-2.5.2-1.2 on GA media
These are all security issues fixed in the opam-2.5.2-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11296-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:21380-1 No score
Security update for opam
This update for opam fixes the following issues:
Changes in opam:
-
Update to version 2.5.2 (CVE-2026-57825) see included CHANGES file for details
-
Update to version 2.5.1 (CVE-2026-41082 bsc#1262281) see included CHANGES file for details
-
Update to version 2.5.0 see included CHANGES file for details
- Record
openSUSE-SU-2026:21380-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
opamAlpine:v3.23 |
before 2.5.2-r0 | 2.5.2-r0 |
opamAlpine:v3.24 |
before 2.5.2-r0 | 2.5.2-r0 |
opamDebian:12 |
before 2.1.2-1+deb12u2, plus listed versions 2.1.2-12.1.2-1+deb12u1 |
2.1.2-1+deb12u2 |
opamDebian:13 |
before 2.3.0-1+deb13u2, plus listed versions 2.3.0-12.3.0-1+deb13u1 |
2.3.0-1+deb13u2 |
opamDebian:14 |
before 2.5.2-1, plus listed versions 2.3.0-12.4.1-12.5.0-12.5.1-12.5.1-2 |
2.5.2-1 |
opam-developam |
before 2.5.2, plus listed versions 2.0~alpha52.0.0~beta2.0.0~beta32.0.0~beta3.12.0.0~beta5 Show 45 moreShow less2.0.0~rc2.0.0~rc22.0.0~rc32.0.02.0.12.0.22.0.32.0.42.0.52.0.62.0.72.0.82.0.92.0.102.1.0~beta22.1.0~beta42.1.0~rc2.1.0~rc22.1.02.1.12.1.22.1.32.1.42.1.52.1.62.2.0~alpha2.2.0~alpha22.2.0~alpha32.2.0~beta12.2.0~beta22.2.0~beta32.2.0~rc12.2.02.2.12.3.0~alpha12.3.0~beta12.3.0~beta22.3.0~rc12.3.02.4.0~alpha12.4.0~alpha22.4.0~beta12.4.0~rc12.4.02.4.1 |
2.5.2 |
opamUbuntu:16.04:LTS |
All versions, plus listed versions 1.2.2-31.2.2-3build11.2.2-4 |
None known |
opamUbuntu:18.04:LTS |
All versions, plus listed versions 1.2.2-6 |
None known |
opamUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 2.0.5-12.0.5-1ubuntu12.0.5-1ubuntu1+esm1 |
None known |
opamUbuntu:22.04:LTS |
All versions, plus listed versions 2.0.8-12.0.10-12.1.2-12.1.2-1+deb12u1build0.22.04.1 |
None known |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
opamUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 2.1.5-12.1.5-1ubuntu0.1~esm2 |
None known |
opamUbuntu:26.10 |
All versions, plus listed versions 2.5.0-12.5.2-1 |
None known |
opamUbuntu:Pro:26.04:LTS |
All versions, plus listed versions 2.3.0-12.4.1-12.5.0-12.5.0-1ubuntu0.1~esm1 |
None known |
opamopenSUSE:Tumbleweed |
before 2.5.2-1.2 | 2.5.2-1.2 |
opamopenSUSE:Leap 16.0 From an advisory covering 2 CVEs |
before 2.5.2-bp160.1.1 | 2.5.2-bp160.1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | OSV | |
| affected, facts | ||
| affected, aliases, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-57825 is a medium vulnerability (CVSS 5.7) in Ocaml Opam, published July 7, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.47%, the 41st percentile. Fixed in opam 2.5.2-r0.
References
github.com/ocaml/opam/releases
osv.dev/vulnerability/OSEC-2026-10
lists.debian.org/debian-lts-announce/2026/07/msg00026.html
nvd.nist.gov/vuln/detail/CVE-2026-57825
security.alpinelinux.org/vuln/CVE-2026-57825
Show 10 moreShow less
security-tracker.debian.org/tracker/CVE-2026-57825
ubuntu.com/security/CVE-2026-57825
cve.org/CVERecord?id=CVE-2026-57825
suse.com/security/cve/CVE-2026-57825
bugzilla.suse.com/1262281
Left out here: 5 versions. The JSON record has them.