CVE-2026-41082: OCaml opam Path Traversal Vulnerability

CVE-2026-41082 Overview

A path traversal vulnerability exists in OCaml opam before version 2.5.1. The vulnerability allows a .install field containing a destination filepath to use ../ sequences to escape the intended directory and reach a parent directory. This directory traversal flaw (CWE-24) can enable attackers to write files to arbitrary locations on the filesystem, potentially leading to code execution or system compromise.

Critical Impact

Attackers can leverage malicious opam packages to write arbitrary files outside the intended installation directory, potentially overwriting critical system files or placing malicious executables in sensitive locations.

Affected Products

• OCaml opam versions prior to 2.5.1

Discovery Timeline

• 2026-04-16 - CVE-2026-41082 published to NVD
• 2026-04-16 - Last updated in NVD database

Technical Details for CVE-2026-41082

Vulnerability Analysis

This vulnerability is classified as a Path Traversal issue (CWE-24: Path Traversal: '../filedir'). The flaw exists in how opam processes .install files during package installation. When a package defines installation destinations in its .install file, opam fails to properly validate and sanitize the destination filepath, allowing the use of parent directory traversal sequences (../).

The local attack vector requires the attacker to craft a malicious opam package that a victim would install. Once installed, the malicious package can write files to arbitrary locations accessible by the user running opam, potentially enabling further exploitation such as privilege escalation or persistent access.

Root Cause

The root cause is insufficient input validation of destination filepaths specified in the .install field of opam packages. The opam package manager does not properly canonicalize or validate paths before writing files, allowing relative path sequences like ../ to traverse outside the intended installation directory structure.

Attack Vector

The attack requires local access in the context of installing a malicious opam package. An attacker would need to:

1. Create a malicious opam package with a crafted .install file containing path traversal sequences
2. Publish the package to a repository or trick the victim into installing it locally
3. When the victim installs the package, files are written to attacker-controlled locations outside the expected installation path

The vulnerability can be exploited by specifying a destination path such as ../../.bashrc or similar traversal sequences in the .install file, causing opam to write files to unintended locations during the installation process.

Detection Methods for CVE-2026-41082

Indicators of Compromise

• Unexpected files appearing in directories outside opam installation paths
• Modified system configuration files (e.g., shell profiles, cron jobs) following opam package installations
• Suspicious .install files in opam packages containing ../ sequences
• Unusual file write operations during opam package installation activities

Detection Strategies

• Monitor file system activity during opam operations for writes outside expected installation directories
• Implement file integrity monitoring on critical system directories and configuration files
• Audit opam packages before installation by inspecting .install file contents for path traversal patterns
• Use security tooling to detect path traversal patterns (../) in package metadata

Monitoring Recommendations

• Enable detailed logging for opam package installation operations
• Monitor for file creation or modification events in sensitive directories that correlate with opam activity
• Implement alerting for any file write operations containing path traversal sequences
• Review opam package sources and maintain an allowlist of trusted package repositories

How to Mitigate CVE-2026-41082

Immediate Actions Required

• Upgrade OCaml opam to version 2.5.1 or later immediately
• Audit recently installed opam packages for potential exploitation
• Review system for any unauthorized file modifications that may have occurred prior to patching
• Restrict opam package installations to trusted repositories only

Patch Information

The vulnerability has been addressed in opam version 2.5.1. Users should upgrade to this version or later to remediate the vulnerability. Technical details about the fix can be found in the GitHub Pull Request #6897, and the patched release is available at GitHub Release 2.5.1.

Workarounds

• Avoid installing opam packages from untrusted sources until the upgrade is applied
• Manually inspect .install files in packages before installation to detect path traversal sequences
• Run opam operations in a sandboxed environment with restricted filesystem access
• Use filesystem permissions to limit write access to sensitive directories for the user running opam

# Upgrade opam to patched version 2.5.1
opam update
opam upgrade opam-installer

# Verify opam version after upgrade
opam --version
# Expected output: 2.5.1 or later

# Alternatively, download and install directly from GitHub releases
# wget https://github.com/ocaml/opam/releases/download/2.5.1/opam-2.5.1-x86_64-linux
# chmod +x opam-2.5.1-x86_64-linux
# sudo mv opam-2.5.1-x86_64-linux /usr/local/bin/opam