CVE-2026-57825
In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 5.7
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
- EPSS probability
- 0.31%
- CWE
- CWE-61
- Published
- 2026-09-09
- Last modified
- 2026-09-09
Affected products
- OCaml opam
Weakness type
Related vulnerabilities
- CVE-2026-79939 — Dell PowerProtect Cyber Recovery, versions Prior to 20.3, contain an UNIX Symbolic Link (Symlink)...
- CVE-2026-75038 — Predictable temporary file in /tmp allows symlink attack in LACT
- CVE-2026-55168 — Runtipi: Authenticated arbitrary file write via backup restore symlink planting
- CVE-2026-63125 — Incus vulnerable to root RCE via image backup.yaml symlink
- CVE-2026-64846 — Nix: Arbitrary file truncation outside the sandbox with recursive-nix experimental feature
- CVE-2026-32657 — Dell AppSync Version 4.6.0.0, Dell Metro Node Version 8.0.0, Dell UCC Edge Version 3.0.1, Dell...
- CVE-2026-47766 — crun follows rootfs /dev symlink while creating default devices
- CVE-2026-53802 — rsync < 3.5.0 Arbitrary File Read via Symlink Following