The vulnerability CVE-2026-41082 affects OCaml opam prior to version 2.5.1. The issue arises because the .install field in opam packages can include '../' sequences, enabling path traversal to parent directories. This flaw can be exploited to write files outside the designated installation directory, potentially leading to integrity and availability impacts. The CVSS 3.1 base score is 7.3, indicating a high severity with local attack vector, low attack complexity, no privileges required, no user interaction, and impacts including low confidentiality, high integrity, and low availability.

An attacker who can control the .install field in an opam package can cause files to be written outside the intended directory structure, potentially overwriting or creating files in parent directories. This can compromise system integrity and availability. Confidentiality impact is low as the vulnerability primarily concerns file write paths.

No official fix or patch is explicitly stated in the vendor advisory. Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-41082 for current remediation guidance. Until a fix is available, avoid installing untrusted opam packages or review .install fields for path traversal sequences before installation.