Opam
Monthly
Arbitrary file write in OCaml opam before 2.5.1 allows a malicious package to escape its intended installation scope: a destination filepath in a package's .install field can contain ../ sequences to reach parent directories and drop files outside the target prefix. Exploitation requires a user to install a crafted opam package, so it is a supply-chain/local vector rather than a remote one. Tracked as OSEC-2026-03 and fixed in opam 2.5.1; no public exploit identified at time of analysis and EPSS is negligible (0.01%).
Arbitrary file write in OCaml opam before 2.5.1 allows a malicious package to escape its intended installation scope: a destination filepath in a package's .install field can contain ../ sequences to reach parent directories and drop files outside the target prefix. Exploitation requires a user to install a crafted opam package, so it is a supply-chain/local vector rather than a remote one. Tracked as OSEC-2026-03 and fixed in opam 2.5.1; no public exploit identified at time of analysis and EPSS is negligible (0.01%).