In prior to version 2.5.1 of OCaml's opam package manager, the installer script field named ".install" allows a package author to specify a destination path for an installed file. A malicious package can insert the string "../" into this path, causing opam to write the file outside the intended package directory and potentially into system‑wide locations. The effect is unauthorized modification of files that may lead to privilege escalation, configuration tampering, or denial of service if critical files are overwritten.

The affected product is OCaml's opam, with all releases preceding 2.5.1 impacted. Packages that contain a malicious ".install" field within these versions pose the risk.

The vulnerability carries a CVSS score of 7.3, indicating high severity, and is not currently listed in the CISA Known Exploited Vulnerabilities catalog. EPSS data is not available, but the lack of availability does not mitigate the inherent risk. The likely attack vector is misuse of a malicious package either through a local repository or by convincing a user to install a compromised package. Successful exploitation requires the ability to supply or run an opam install command with the tainted package.