The vulnerability CVE-2026-41082 affects OCaml opam prior to version 2.5.1. It involves improper handling of the .install field in package definitions, where the use of '../' sequences in destination file paths enables path traversal. This allows an attacker to write files outside the intended directory hierarchy, potentially leading to unauthorized modification of files. The CVSS 3.1 base score is 7.3, reflecting a high severity with local attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker with local access to write files to arbitrary locations on the filesystem, potentially overwriting critical files or placing malicious files outside the intended directory. This can lead to partial loss of confidentiality, high integrity impact, and low availability impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 2.5.1, upgrading to version 2.5.1 or later (if available) is recommended once confirmed. Until then, avoid using untrusted .install fields that contain relative path sequences. Monitor official OCaml opam channels for updates.