5.7
CVE-2026-57825
- EPSS 0.31%
- Veröffentlicht 09.09.2026 00:00:00
- Zuletzt bearbeitet 14.09.2026 16:17:15
- Erkennungen
In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerOCaml
≫
Produkt
opam
Default Statusunaffected
Version
0
Version <
2.5.2
Status
affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.31% | 0.239 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| MITRE | 5.7 | 2.1 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
|
CWE-61 UNIX Symbolic Link (Symlink) Following
The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.
https://github.com/ocaml/opam/releases
https://osv.dev/vulnerability/OSEC-2026-10
https://lists.debian.org/debian-lts-announce/2026/07/msg00026.html