CVE-2026-41082

CVE-2026-41082 is a path traversal vulnerability in OCaml opam package manager versions prior to 2.5.1, where malicious .install files can use relative path traversal (../) sequences to write files to parent directories outside the intended installation location. This vulnerability affects the opam package management system used in OCaml development environments. The flaw has a CVSS score of 7.3 (HIGH) with a local attack vector, low complexity, and no privilege or user interaction required, resulting in low confidentiality impact, high integrity impact, and low availability impact. There is no evidence of active exploitation at this time, as the vulnerability is not listed in the Known Exploited Vulnerabilities catalog and shows minimal community attention with an EPSS score of 0.00006. Users should upgrade to opam 2.5.1 or later to remediate this issue, though the low exploitation probability suggests it is not currently a widespread threat in the wild.