CVE-2026-57825

Name of the Vulnerable Software and Affected Versions opam versions prior to 2.5.2

Description Installing files via .install files does not verify symlink resolution of the target path, which allows for the bypass of sandboxing. An attacker can use a malicious .install file in combination with a symlink created during the installation process to write files outside the intended sandbox directory, such as the user home directory.

Recommendations Update to version 2.5.2.