CVE-2026-41082

· NIST NVD ↗

In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.

HIGH
CVSS severity
7.3
CVSS base score
2026-04-16
Published

CWE codes

CWE-24

Sources