In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.

Summary

.install files do not validate whether they are inside the package area, and so can bypass sandboxing.

Exploit

In a package.install file, this installs a file as ~/.bashrc: bin: [ "payload.sh" {"../../../.bashrc"} ]

Timeline

- 2026-04-11: Anil forwarded the issue from Andrew Nesbitt to the OCaml security team - 2026-04-11: Kate developed a fix - 2026-04-15: opam 2.5.1 was released with the fix