Skip to content
Sign in
5.7 Medium

CVE-2026-57825 In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are…

Description

In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files.

Affected products and versions

Product Affected versions Fixed in
opam 2.5 earliest → < 2.5.2 2.5.2

Other CVEs of opam

The 2 CVEs of opam →
CVE-2026-41082 In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory 7.3 High
Track this CVE