CVE-2026-41082

תיאור (מקור, אנגלית)

In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.

מדדים

CVSS 3.1

7.8 (HIGH) מקור הציון: NVD CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS — סבירות ניצול

0% (אחוזון 000) נכון ל-28/7/2026

CWE

CWE-24, CWE-22

מוצרים מושפעים

ocaml: opam; debian: debian linux; redhat: enterprise linux

קישורים

• https://github.com/ocaml/opam/pull/6897 Issue TrackingPatch
• https://github.com/ocaml/opam/releases/tag/2.5.1 Release Notes
• https://osv.dev/vulnerability/OSEC-2026-03 Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2026/04/msg00021.html Mailing ListThird Party Advisory
• https://access.redhat.com/security/cve/CVE-2026-41082 Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2459003 Issue Tracking
• https://osv.dev/vulnerability/OSEC-2026-03 Third Party Advisory
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41082.json Third Party Advisory