7.3
High
CVE-2026-41082 In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory
Description
In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| opam 2.5 | earliest → < 2.5.1 | 2.5.1 |
| Red Hat Enterprise Linux 10 | Versions not published |