---
id: CVE-2026-41082
title: >-
  In OCaml opam before 2.5.1, a .install field containing a destination filepath
  can use ../ to reach a parent directory.
summary: >-
  In OCaml opam before 2.5.1, a .install field containing a destination filepath
  can use ../ to reach a parent directory.
severity: high
cvss: 7.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L'
cwe:
  - CWE-24
  - CWE-22
  - CWE-24
vendor: ocaml
product: opam
affected:
  - opam < 2.5.1
  - debian_linux = 11.0
  - enterprise_linux = 10.0
patched:
  - opam 2.5.1
published: '2026-04-16'
updated: '2026-07-08'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-41082'
references:
  - url: 'https://github.com/ocaml/opam/pull/6897'
    label: cve@mitre.org
  - url: 'https://github.com/ocaml/opam/releases/tag/2.5.1'
    label: cve@mitre.org
  - url: 'https://osv.dev/vulnerability/OSEC-2026-03'
    label: cve@mitre.org
  - url: 'https://lists.debian.org/debian-lts-announce/2026/04/msg00021.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://access.redhat.com/security/cve/CVE-2026-41082'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2459003'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://osv.dev/vulnerability/OSEC-2026-03'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41082.json
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
tags:
  - nvd
epss: 0.00216
epssPercentile: 0.10725
ingestedAt: '2026-07-08T03:46:38.650Z'
---

## Overview

In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.

## Affected

- `opam < 2.5.1`
- `debian_linux = 11.0`
- `enterprise_linux = 10.0`

## Remediation

Upgrade past the affected range:

- `opam 2.5.1`