CVEFinder.io

CVE-2026-41082

⚠ī¸ high
🔍 Scan for this CVE
Summary

In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.

CVSS Score
7.3
High
EPSS Score
0.2
Exploit Probability
Published Date
2026-04-16
First Seen: 2026-04-20
📊 Relative Risk Intelligence

This CVE is Moderate Risk - more severe than 55.4% of all 335,187 vulnerabilities in our database.

#149,529
Above average severity
Severity Percentile
đŸŽ¯ CISA SSVC Assessment Updated: Jun 16, 2026
🔍 Exploitation Status
Poc
Proof-of-concept available
⚙ī¸ Automatable
NO
Requires human interaction
đŸ’Ĩ Technical Impact
Partial
Limited system impact
SSVC data provided by CISA
Last Modified 2026-07-08
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
CWE IDs (Weakness Types)
CWE-24 CWE-22

đŸ“Ļ Affected Products 2

Vendor Product Status Affected Versions
debian debian_linux Affected
v11.0
redhat enterprise_linux Affected
v10.0

🔗 References 7

https://github.com/ocaml/opam/pull/6897
Issue Tracking Patch
https://github.com/ocaml/opam/releases/tag/2.5.1
Release Notes
https://osv.dev/vulnerability/OSEC-2026-03
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2026/04...
Mailing List Third Party Advisory
https://access.redhat.com/security/cve/CVE-2026-41082
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2459003
Issue Tracking
https://security.access.redhat.com/data/csaf/v2/vex/...
Third Party Advisory

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-15041 ℹī¸ low 3.7 0.3 A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password verification function uses standard memcmp() for co... 2026-07-08
CVE-2026-58384 ⚠ī¸ high 7.3 0.2 A flaw was found in GIMP's PSD parser. An integer overflow in read_RLE_channel() can cause an undersized heap allocation... 2026-07-07
CVE-2026-14940 đŸ”ļ medium 5.3 0.3 A heap-buffer-overflow flaw was found in 389 Directory Server (389-ds-base). When normalizing a Distinguished Name (DN) ... 2026-07-07
CVE-2026-14969 đŸ”ļ medium 4.4 0.1 A flaw was found in 389-ds-base where the LDBM backend attribute encryption uses a hardcoded static initialization vecto... 2026-07-07
CVE-2026-58380 ⚠ī¸ high 7.3 0.2 A flaw was found in GIMP's PNM file format parser. When parsing a specially crafted PNM file, the pnmscanner_gettoken() ... 2026-07-06
CVE-2026-59089 đŸ”ļ medium 5.5 0.2 A flaw was found in GIMP. The PlayStation TIM loader, responsible for handling PlayStation image files, incorrectly calc... 2026-07-06
These CVEs affect the same products