Threats affecting pkg:github/ocaml/opam

2 threats

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Medium	5.7	EPSS 0.5%	CVE-2026-57825OCaml opam · UNIX Symbolic Link (Symlink) Following Medium5.7EPSS 0.5%2026-09-09CVE Database V5CVE-2026-57825 CVE-2026-57825 is a medium severity vulnerability in the opam package manager for OCaml. Versions before 2.5.2 mishandle symbolic links during the processing of .install files, allowing the sandbox protection mechanism to be bypassed. This flaw can lead to integrity violations but does not impact confidentiality or availability. EPSS 0.5%Vulnerability CWE-61 #ghsa-rwq5-7hr3-r2qf	CVE Database V5	2026-09-09
High	7.3	EPSS 0.2%	CVE-2026-41082OCaml opam · Path Traversal: '../filedir High7.3EPSS 0.2%2026-04-16CVE Database V5CVE-2026-41082 In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory. EPSS 0.2%Vulnerability CWE-24	CVE Database V5	2026-04-16

Page 1 of 1