What is GHSA-97q5-qf47-hvrw?

GHSA-97q5-qf47-hvrw is a security advisory published by GitHub Security Advisories with High severity. In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to...

Which CVE IDs does GHSA-97q5-qf47-hvrw cover?

GHSA-97q5-qf47-hvrw covers the following CVE IDs: CVE-2026-41082. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-97q5-qf47-hvrw?

GHSA-97q5-qf47-hvrw has a CVSS v3 base score of 7.3, published by GitHub Security Advisories.

GHSA-97q5-qf47-hvrwHighCVSS 7.3

In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to...

Vendor

GitHub Security Advisories

Published

April 16, 2026

Last Modified

June 15, 2026

🔗 CVE IDs covered (1)

CVE-2026-41082 →

📋 Description

In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2026-41082
https://github.com/ocaml/opam/pull/6897
https://github.com/ocaml/opam/releases/tag/2.5.1
https://lists.debian.org/debian-lts-announce/2026/04/msg00021.html
https://osv.dev/vulnerability/OSEC-2026-03
https://github.com/advisories/GHSA-97q5-qf47-hvrw