CVE-2026-57825VulnerabilityPublished 09/09/2026Updated 09/14/2026

CVE-2026-57825: CWE-61 UNIX Symbolic Link (Symlink) Following in OCaml opam

Affects OCaml opamSource CVE Database V5

ghsa-rwq5-7hr3-r2qf

Not known to be exploited · CVSS 5.7 Medium · fixed in 2.5.2 : update OCaml opam when convenient.

Data as of 10/25/2026, 04:40:13 UTC

CVSS 3.1 base score

5.7Medium

How severe the flaw is on the 0–10 CVSS scale.

Exploitation: Not in CISA KEV, no exploitation reported
EPSS: 0.4% chance of exploitation in 30 days – higher than 39% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 2.5.2

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

Attack Vector: Network
Attack Complexity: Low
Privileges Required: Low
User Interaction: Required
Scope: Unchanged
Confidentiality: None
Integrity: High
Availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: Low: The attacker is authorized with (i.e., requires) privileges that provide basic user capabilities that could normally affect only settings and files owned by a user. Alternatively, an attacker with Low privileges may have the ability to cause an impact only to non-sensitive resources.
User Interaction: Required: Successful exploitation of this vulnerability requires a user to take some action before the vulnerability can be exploited.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: None: There is no loss of confidentiality within the impacted component.
Integrity: High: There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the impacted component. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the impacted component.
Availability: None: There is no impact to availability within the impacted component.

Definitions: FIRST CVSS v3.1 specification.

What to do

Affected software

Product	Affected	Fixed in
OCamlopam	Affected <2.5.2	Fixed in 2.5.2
GitHubocaml/opam`pkg:github/ocaml/opam`Other threats	Affected <2.5.2	Fixed in 2.5.2

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

A fix is available in opam version 2.5.2. Users should upgrade to version 2.5.2 or later to remediate this vulnerability. No additional mitigation steps are indicated by the vendor advisory.

Description

CVE-2026-57825 is a medium severity vulnerability in the opam package manager for OCaml. Versions before 2.5.2 mishandle symbolic links during the processing of .install files, allowing the sandbox protection mechanism to be bypassed. This flaw can lead to integrity violations but does not impact confidentiality or availability.

Impact

An attacker with some level of privileges and the ability to trigger .install file processing can bypass sandbox protections due to symlink mishandling. This can lead to unauthorized modification of files, compromising system integrity. There is no direct impact on confidentiality or availability according to the CVSS vector. No known exploits are reported in the wild.

Summary

The vulnerability identified as CVE-2026-57825 affects opam versions prior to 2.5.2. It involves improper handling of UNIX symbolic links (symlinks) within the sandbox protection mechanism when .install files are used. This mishandling allows an attacker with limited privileges to bypass sandbox restrictions, potentially leading to unauthorized modification or integrity compromise of files. The CVSS 3.1 base score is 5.7, reflecting a network attack vector with low attack complexity, requiring privileges and user interaction, and resulting in high impact on integrity but no impact on confidentiality or availability.

Weaknesses

CWE-61UNIX Symbolic Link (Symlink) Following (opens in a new tab)
Compound weaknessLikelihood of exploit: HighOWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.
Implementation
Symbolic link attacks often occur when a program creates a tmp directory that stores files/links. Access to the directory should be restricted to the program as to prevent attackers from manipulating the files.
Architecture and Design · Separation of Privilege
Follow the principle of least privilege when assigning access rights to entities in a software system.
OWASP Cheat Sheets
Authorization (opens in a new tab)
Attack patterns
Leveraging Race Conditions via Symbolic Links (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…