Summary
Andrew Nesbitt discovered that opam did not properly validate file
destination paths in package install files. An attacker could use this
issue to bypass sandbox protections and write files to arbitrary locations,
possibly leading to arbitrary code execution.
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | opam | 2.1.2-1+deb12u1build0.22.04.1 |
| Ubuntu · 25.10 | opam | 2.3.0-1+deb13u1build0.25.10.1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | opam | 2.0.5-1ubuntu1+esm1 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | opam | 2.1.5-1ubuntu0.1~esm2 |
| Ubuntu · Pro 26.04 LTS Pro:26.04:LTS | opam | 2.5.0-1ubuntu0.1~esm1 |
References
-
report
https://ubuntu.com/security/CVE-2026-41082