OCaml opam CVE-2026-41082

Requires the victim to install a crafted opam package whose .install field contains a destination filepath with ../ traversal sequences - that malicious .install content IS the specific trigger condition. Exploitation is limited by mandatory user interaction (the victim must run an install of the attacker-supplied package), by the local attack vector (no remote/network trigger), and by the writable filesystem scope of the account running opam (a non-root install cannot reach root-owned paths). It affects all opam versions before 2.5.1 in default configuration; no special non-default feature toggle is needed beyond normal package installation.

The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) reflects a local, user-interaction-gated flaw rather than a remotely triggerable one - the 7.8 is driven by high C/I/A impact, not by remote reachability. This is corroborated by the CISA SSVC assessment: Exploitation 'none', Automatable 'no', Technical Impact 'partial', and by EPSS at 0.01% (0th percentile), indicating no meaningful mass-exploitation pressure. It is not on CISA KEV and no POC is referenced. Note a data inconsistency worth flagging: the tags label this 'Information Disclosure' and CVSS sets C:H, but the mechanism is fundamentally an arbitrary file WRITE (path traversal on install destinations), so integrity/availability impact is the more accurate primary consequence - verify the confidentiality rating against the actual write primitive. Realistically this is a moderate, opportunistic supply-chain risk: it requires a victim to install a malicious or compromised package, which limits blast radius but is a legitimate threat in package-manager ecosystems.

An attacker publishes (or compromises) an opam package whose .install file specifies a destination such as ../../../../home/victim/.bashrc or a path into the user's PATH; when the victim runs opam install on that package, opam writes attacker-controlled content outside the intended prefix, potentially overwriting a startup script or a binary that later executes. Because the flaw is a file-write primitive gated by the install action, follow-on code execution occurs when the clobbered file is next used. No public POC is referenced, and the vector requires the victim to install the malicious package.