{"id":"CVE-2026-41082","aliases":["DEBIAN-CVE-2026-41082","EUVD-2026-23288","GHSA-97q5-qf47-hvrw","MGASA-2026-0116","OSEC-2026-03","UBUNTU-CVE-2026-41082","USN-8256-1","openSUSE-SU-2026:10568-1","openSUSE-SU-2026:21380-1"],"status":"published","title":"In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to...","description":"In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00205,"percentile":0.10603,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22","CWE-24"],"published":"2026-04-15T22:00:00Z","modified":"2026-11-06T13:45:04Z","fixes":[{"ecosystem":"Debian:12","package":"opam","fixed_in":["2.1.2-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"opam","fixed_in":["2.3.0-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"opam","fixed_in":["2.5.1-1"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"opam","fixed_in":["2.1.3-1.1.mga9"],"sources":["osv"]},{"ecosystem":"opam","package":"opam-devel","fixed_in":["2.5.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"opam","fixed_in":["2.0.5-1ubuntu1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"opam","fixed_in":["2.1.2-1+deb12u1build0.22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"opam","fixed_in":["2.1.5-1ubuntu0.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"opam","fixed_in":["2.3.0-1+deb13u1build0.25.10.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:26.04:LTS","package":"opam","fixed_in":["2.5.0-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"opam","fixed_in":["2.5.1-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"opam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-1+deb12u1"}]}],"versions":["2.1.2-1"]},{"source":"osv","ecosystem":"Debian:13","package":"opam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-1+deb13u1"}]}],"versions":["2.3.0-1"]},{"source":"osv","ecosystem":"Debian:14","package":"opam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-1"}]}],"versions":["2.3.0-1","2.4.1-1","2.5.0-1"]},{"source":"osv","ecosystem":"Mageia:9","package":"opam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.3-1.1.mga9"}]}]},{"source":"osv","ecosystem":"opam","package":"opam-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1"}]}],"versions":["2.0~alpha5","2.0.0~beta","2.0.0~beta3","2.0.0~beta3.1","2.0.0~beta5","2.0.0~rc","2.0.0~rc2","2.0.0~rc3","2.0.0","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9","2.0.10","2.1.0~beta2","2.1.0~beta4","2.1.0~rc","2.1.0~rc2","2.1.0","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.2.0~alpha","2.2.0~alpha2","2.2.0~alpha3","2.2.0~beta1","2.2.0~beta2","2.2.0~beta3","2.2.0~rc1","2.2.0","2.2.1","2.3.0~alpha1","2.3.0~beta1","2.3.0~beta2","2.3.0~rc1","2.3.0","2.4.0~alpha1","2.4.0~alpha2","2.4.0~beta1","2.4.0~rc1","2.4.0","2.4.1","2.5.0~alpha1","2.5.0~beta1","2.5.0~rc1","2.5.0"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"opam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.2-3","1.2.2-3build1","1.2.2-4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"opam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.2-6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"opam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.5-1ubuntu1+esm1"}]}],"versions":["2.0.5-1","2.0.5-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"opam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-1+deb12u1build0.22.04.1"}]}],"versions":["2.0.8-1","2.0.10-1","2.1.2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"opam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.5-1ubuntu0.1~esm2"}]}],"versions":["2.1.5-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"opam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-1+deb13u1build0.25.10.1"}]}],"versions":["2.3.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"opam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.5.0-1","2.5.2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"opam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1ubuntu0.1~esm1"}]}],"versions":["2.3.0-1","2.4.1-1","2.5.0-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"opam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.5-1ubuntu1+esm1"}]}],"versions":["2.0.5-1","2.0.5-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"opam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-1+deb12u1build0.22.04.1"}]}],"versions":["2.0.8-1","2.0.10-1","2.1.2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"opam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.5-1ubuntu0.1~esm2"}]}],"versions":["2.1.5-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"opam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-1+deb13u1build0.25.10.1"}]}],"versions":["2.3.0-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"opam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1ubuntu0.1~esm1"}]}],"versions":["2.3.0-1","2.4.1-1","2.5.0-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"opam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"opam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.2-bp160.1.1"}]}],"bundled":2}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"ocaml","product":"opam"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"redhat","product":"enterprise_linux"}],"references":[{"url":"https://github.com/ocaml/opam/releases/tag/2.5.1","tags":["Release Notes","web"]},{"url":"https://github.com/ocaml/opam/pull/6897","tags":["Issue Tracking","Patch","fix"]},{"url":"https://osv.dev/vulnerability/OSEC-2026-03","tags":["exploit","Third Party Advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2026/04/msg00021.html","tags":["Mailing List","Third Party Advisory","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-41082","tags":["vdb-entry","x_refsource_REDHAT","Third Party Advisory","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2459003","tags":["issue-tracking","x_refsource_REDHAT","Issue Tracking","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41082.json","tags":["x_sadp-csaf-vex","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41082","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-97q5-qf47-hvrw"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41082.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-41082","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0116.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35405","tags":["report"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00126.html","tags":["web"]},{"url":"https://github.com/ocaml/opam/pull/6898","tags":["fix"]},{"url":"https://ubuntu.com/security/CVE-2026-41082","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-41082","tags":["report"]},{"url":"https://github.com/ocaml/security-advisories/blob/main/advisories/2026/OSEC-2026-03.md","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8256-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41082","tags":["web"]},{"url":"https://bugzilla.suse.com/1262281","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-57825","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-41082","description":"In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.","status":"published","published":"2026-04-16T17:32:40.068Z","modified":"2026-07-15T01:00:03.411Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L","level":"high","assessor":"cna"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-24","CWE-24"],"updated_at":"2026-11-02T13:41:08.498858Z"}],"euvd":[{"id":"EUVD-2026-23288","description":"In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.","status":"published","published":"2026-04-16T17:32:40Z","modified":"2026-07-15T01:00:03Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T18:19:56.47701Z"}],"ghsa":[{"id":"GHSA-97q5-qf47-hvrw","title":"In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to...","description":"In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.","status":"published","published":"2026-04-16T18:31:22Z","modified":"2026-07-08T03:31:27Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L","level":"high"}],"cwes":["CWE-22","CWE-24"],"updated_at":"2026-11-02T15:09:18.783285Z"}],"nvd":[{"id":"CVE-2026-41082","description":"In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.","status":"published","published":"2026-04-16T18:16:45.98Z","modified":"2026-10-26T21:10:00.17Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-24","CWE-22"],"updated_at":"2026-11-02T14:12:15.120927Z"}],"osv":[{"id":"CVE-2026-41082","description":"In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.","status":"published","published":"2026-04-16T17:32:40.068Z","modified":"2026-10-28T02:30:48.153223819Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L","level":"high"}],"cwes":["CWE-24"],"updated_at":"2026-11-02T15:45:03.424067Z"},{"id":"DEBIAN-CVE-2026-41082","description":"In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.","status":"published","published":"2026-04-16T18:16:45.98Z","modified":"2026-10-27T09:47:31.434426392Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:54.892385Z"},{"id":"OSEC-2026-03","title":"opam install sandbox escape","description":"## Summary\n\n`.install` files do not validate whether they are inside the package area, and so can bypass sandboxing.\n\n## Exploit\n\nIn a `package.install` file, this installs a file as ``~/.bashrc`:\n```\nbin: [\n  \"payload.sh\" {\"../../../.bashrc\"}\n]\n```\n\n## Timeline\n\n- 2026-04-11: Anil forwarded the issue from Andrew Nesbitt to the OCaml security team\n- 2026-04-11: Kate developed a fix\n- 2026-04-15: opam 2.5.1 was released with the fix","status":"published","published":"2026-04-15T22:00:00Z","modified":"2026-11-06T13:45:04.187526332Z","cvss":[{"version":"3.0","score":5.7,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-06T14:15:36.533219Z"},{"id":"UBUNTU-CVE-2026-41082","description":"In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.","status":"published","published":"2026-04-17T00:00:00Z","modified":"2026-10-17T12:58:14.782240849Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L","level":"high"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:16.686388Z"},{"id":"MGASA-2026-0116","title":"Updated opam packages fix security vulnerability","description":"In OCaml opam before 2.5.1, a .install field containing a destination\nfilepath can use ../ to reach a parent directory. (CVE-2026-41082)\n","status":"published","published":"2026-05-07T05:06:13Z","modified":"2026-05-07T05:15:24.418215Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2026:10568-1","title":"opam-2.5.1-1.1 on GA media","description":"These are all security issues fixed in the opam-2.5.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-04-17T00:00:00Z","modified":"2026-04-18T08:01:02.289377Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:21380-1","title":"Security update for opam","description":"This update for opam fixes the following issues:\n\nChanges in opam:\n\n- Update to version 2.5.2 (CVE-2026-57825)\n  see included CHANGES file for details\n\n- Update to version 2.5.1 (CVE-2026-41082 bsc#1262281)\n  see included CHANGES file for details\n\n- Update to version 2.5.0\n  see included CHANGES file for details\n","status":"published","published":"2026-07-18T19:33:53Z","modified":"2026-07-22T18:25:11.646205272Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"USN-8256-1","title":"opam vulnerability","description":"Andrew Nesbitt discovered that opam did not properly validate file\ndestination paths in package install files. An attacker could use this\nissue to bypass sandbox protections and write files to arbitrary locations,\npossibly leading to arbitrary code execution.","status":"published","published":"2026-05-07T15:21:08Z","modified":"2026-07-09T17:15:48.437353169Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}