A path traversal vulnerability in the ocaml.org website allows unauthenticated attackers to read arbitrary files on the server by exploiting the /conferences/ocaml/** endpoint. The server concatenates the raw request path to a base directory without proper validation, enabling escape from the intended directory. The server process runs as root inside a container, but the container does not contain secrets, so the live deployment has no known impact. The issue was reported on 2026-10-31 and fixed by 2026-11-02.