CVE-2026-57825
published 2026-09-09CVE-2026-57825: In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files.
PriorityP429medium5.7CVSS 3.1
AVNACLPRLUIRSUCNIHAN
EPSS
0.47%
39.9th percentile
In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ocaml | opam | < 2.5.2 | 2.5.2 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-57825 opam: opam: Sandbox escape due to mishandling of symlinks in .install files [fedora-all]
bugzilla·2026-09-09·CVSS 5.7
CVE-2026-57825 [MEDIUM] CVE-2026-57825 opam: opam: Sandbox escape due to mishandling of symlinks in .install files [fedora-all]
CVE-2026-57825 opam: opam: Sandbox escape due to mishandling of symlinks in .install files [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files.
Discussion:
No current Fedora release has opam before 2.5.2. We are on 2.5.2 in F43+.
Bugzilla
CVE-2026-57825 opam: opam: Sandbox escape due to mishandling of symlinks in .install files
bugzilla·2026-09-09·CVSS 5.7
CVE-2026-57825 [MEDIUM] CVE-2026-57825 opam: opam: Sandbox escape due to mishandling of symlinks in .install files
CVE-2026-57825 opam: opam: Sandbox escape due to mishandling of symlinks in .install files
In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files.
2026-09-09
Published