What is the CVSS score of CVE-2026-41082?

CVE-2026-41082 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of OCaml opam are affected by CVE-2026-41082?

OCaml's opam package manager (versions before 2.5.1) allows malicious packages to write files outside their intended installation directories, creating a supply-chain attack vector that can…. A patch is available.

How to fix or mitigate CVE-2026-41082?

Within 24 hours, audit all development systems, CI/CD pipelines, and container images to identify current opam versions in use. Within 7 days, establish and communicate a mandatory upgrade directive to opam 2.5.1, validate compatibility in a staging environment using your current OCaml project dependencies, and restrict package sources to verified trusted repositories only. Within 30 days, complete the upgrade across all development workstations, build servers, and production container base images, and review system logs and file system activity from the past 90 days on any machines that installed packages prior to upgrading, specifically checking for unexpected files created outside the opam prefix directory.

OCaml opam CVE-2026-41082

EUVD-2026-23288 HIGH

Path Traversal: '../filedir' (CWE-24)

2026-04-16 mitre

GHSA-97q5-qf47-hvrw

Information Disclosure Ocaml Opam

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.3 HIGH

Local install-time file-write primitive needing victim interaction (UI:R, AV:L); high integrity/availability impact from arbitrary writes, only limited confidentiality since it is a write, not a read.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

7.3 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

Red Hat

7.1 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 07:30 vuln.today

Analysis Generated

Jul 24, 2026 - 07:30 vuln.today

CVSS changed

Jul 08, 2026 - 03:37 NVD

7.3 (HIGH) 7.8 (HIGH)

Patch released

Apr 21, 2026 - 10:16 nvd

Patch available

Apr 16, 2026 - 19:16 EUVD

EUVD ID Assigned

Apr 16, 2026 - 18:00 euvd

EUVD-2026-23288

CVE Published

Apr 16, 2026 - 17:32 nvd

HIGH 7.8

CVE Published

Apr 16, 2026 - 17:32 nvd

HIGH 7.3

DescriptionNVD

In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.

AnalysisAI

Arbitrary file write in OCaml opam before 2.5.1 allows a malicious package to escape its intended installation scope: a destination filepath in a package's .install field can contain ../ sequences to reach parent directories and drop files outside the target prefix. Exploitation requires a user to install a crafted opam package, so it is a supply-chain/local vector rather than a remote one. Tracked as OSEC-2026-03 and fixed in opam 2.5.1; no public exploit identified at time of analysis and EPSS is negligible (0.01%).

Technical ContextAI

opam is the standard package manager for the OCaml ecosystem. When installing a package, opam processes the .install file, which declares source-to-destination file mappings that place build artifacts (binaries, libraries, docs, config) into the switch or system prefix. The root cause is CWE-24 (Path Traversal: '../filedir'): opam did not properly validate or normalize destination paths, so a ../ component in a declared destination allowed the resolved write target to escape the intended scope. The fix (#6897) invalidates .install fields whose destination filepaths attempt to escape their scope and hardens OpamFilename.might_escape, including correct treatment of / as a separator on Windows. The affected CPE is cpe:2.3:a:ocaml:opam:*:*:*:*:*:*:*:* for all versions prior to 2.5.1.

RemediationAI

Vendor-released patch: opam 2.5.1 - upgrade to 2.5.1 or later, which invalidates .install fields whose destination filepaths escape their scope (PR https://github.com/ocaml/opam/pull/6897, release https://github.com/ocaml/opam/releases/tag/2.5.1). For distribution installs, apply the Debian LTS update (https://lists.debian.org/debian-lts-announce/2026/04/msg00021.html) or the Red Hat fix once shipped (https://access.redhat.com/security/cve/CVE-2026-41082). Until upgraded, the practical compensating control is to install only packages from trusted repositories and pinned sources and to avoid installing untrusted or unaudited opam packages, since the vulnerability triggers during package installation; where feasible, run installs under an unprivileged user and in isolated/containerized switches so that a traversal write cannot reach sensitive system paths - the trade-off is added workflow friction and it does not prevent damage within the reachable filesystem scope of that user.