CVE-2026-41082

Description

In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.

CVSS Vector

References

• https://github.com/ocaml/opam/pull/6897
• https://github.com/ocaml/opam/releases/tag/2.5.1