# CVE-2026-41082: OCaml opam path traversal in .install field

Source: https://junglewise.ai/threats/cve-2026-41082-ocaml-opam-path-traversal-in-install-field  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-16. Updated: 2026-06-15  
License: CC BY 4.0 with a link back

CVE-2026-41082 · Severity: high · CVSS 7.3 · Published 2026-04-16

OCaml opam is a package manager used to install and manage software libraries. A security flaw in how it handles installation instructions allows a malicious package to write files outside of its intended directory. This could allow an attacker to overwrite sensitive system files, such as configuration files, potentially leading to unauthorized system access or persistent control over a user's environment.

Vendors: [OCaml](https://junglewise.ai/threats/vendors/ocaml).

## Quick answers

**Is CVE-2026-41082 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41082 being exploited in the wild.

**How severe is CVE-2026-41082?** High severity, with a CVSS score of 7.3, published 16 April 2026.

**Which products and versions are affected?** OCaml Opam < 2.5.1; OCaml Opam-Devel < 2.5.1.

**Is there a fix for CVE-2026-41082?** A patch was published on 2026-04-15: opam 2.5.1 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41082 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-41082?** Check whether you run OCaml Opam or OCaml Opam-Devel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability exists in OCaml opam's handling of .install files. The root cause is insufficient validation of the destination filepath in the .install field, which allows the use of parent directory references (../) to escape the intended package area. An attacker can exploit this by crafting a malicious package that, when installed, writes files to sensitive locations (e.g., overwriting ~/.bashrc). While the opam manual explicitly forbids absolute paths and parent directory references, the software failed to enforce these restrictions prior to version 2.5.1. The vulnerability is fixed in version 2.5.1 and backported to older supported versions in various distributions.

## Affected products

- OCaml opam < 2.5.1
- OCaml opam-devel < 2.5.1

## Timeline

- 2026-04-11: other: Issue reported to OCaml security team
- 2026-04-15: patched: opam 2.5.1 released with fix
- 2026-04-16: disclosed: CVE-2026-41082 published
- 2026-04-21: advisory: Debian LTS advisory DLA-4541-1 published

## References

- [https://github.com/ocaml/opam/pull/6897](https://github.com/ocaml/opam/pull/6897)
- [https://github.com/ocaml/opam/releases/tag/2.5.1](https://github.com/ocaml/opam/releases/tag/2.5.1)
- [https://lists.debian.org/debian-lts-announce/2026/04/msg00021.html](https://lists.debian.org/debian-lts-announce/2026/04/msg00021.html)

## Related threats

- [opam sandbox escape using symlinks in .install files](https://junglewise.ai/threats/cve-2026-57825-opam-sandbox-escape-using-symlinks-in-install-files)