CVE-2026-57825CWE-61

CVE-2026-57825

Medium · published September 9, 2026

CVSS v3.1
5.7
EPSS
0%
Percentile
39.9
In the wild
Unconfirmed
What it is

In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files.

The record
Technical detail
CVSS v3.1
5.7 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00472 · 39.9th percentile
Weakness
CWE-61 · UNIX Symbolic Link (Symlink) Following
Published
2026-09-09T08:18Z
References (3)
https://github.com/ocaml/opam/releases · [email protected]https://osv.dev/vulnerability/OSEC-2026-10 · [email protected]https://lists.debian.org/debian-lts-announce/2026/07/msg00026.html · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 10 SEP 03:17Z
    EPSS moved — → 0%
    epss
  • 09 SEP 00:00Z
    In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files
    cvelistv5