Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
2 versions affected across 3 products
CVE-2026-41082 In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory. https://www.cve.org/CVERecord?id=CVE-2026-41082
Post summary
A directory‑traversal vulnerability (CVE‑2026‑41082) is disclosed for OCaml opam versions prior to 2.5.1, where the .install field can use '..' to reach parent directories.
CVE-2026-41082 Directory Traversal in OCaml opam Before 2.5.1 via .install Field https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-41082
Post summary
The post references CVE-2026-41082, a directory traversal flaw in OCaml opam prior to v2.5.1 affecting the .install field, but provides no proof of concept, exploit, or active exploitation details.
3 of 3 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | debian | debian_linux | 11.0 | - | - |
| App | ocaml | opam | - | - | - |
| OS | redhat | enterprise_linux | 10.0 | - | - |