CVE-2026-41082

NameCVE-2026-41082
DescriptionIn OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-4541-1, DSA-6216-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
opam (PTS)bullseye2.0.8-1vulnerable
bullseye (security)2.0.8-1+deb11u1fixed
bookworm2.1.2-1vulnerable
bookworm (security)2.1.2-1+deb12u1fixed
trixie2.3.0-1vulnerable
trixie (security)2.3.0-1+deb13u1fixed
forky, sid2.5.1-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
opamsourcebullseye2.0.8-1+deb11u1DLA-4541-1
opamsourcebookworm2.1.2-1+deb12u1DSA-6216-1
opamsourcetrixie2.3.0-1+deb13u1DSA-6216-1
opamsource(unstable)2.5.1-1

Notes

https://github.com/ocaml/security-advisories/blob/main/advisories/2026/OSEC-2026-03.md

Search for package or bug name: Reporting problems