CISA issues alert on OpenCart directory traversal in extension installer
36th article in the last 90 days, one of 579 articles referencing Cybersecurity and Infrastructure Security Agency (CISA). Previous coverage: CISA issues notice on authentication bypass in ARRIS BGW210-700 LAN management interface (Aug 2026).
Companies mentioned
Best suited for
- Seniority
- C Level / Executive Team
- Job function
- Chief Information Security Officer
- Persona
- Security Operations Leader
- Buyer role
- Decision Maker / Budget Holder
- Buyer journey
- Need to Buy
- Adoption curve
- Late Majority
- Technology maturity
- Established Technology
- Industry
- Consumer Discretionary / Retailing
Our classification, not the publisher's statement. Best suited for, not only for.
OpenCart v4.2.0.0 has a directory traversal issue in its extension installer. The flaw can enable a user who installs a malicious extension to write files into the webroot directory, which can lead to remote code execution.
The vulnerability is tracked as CVE-2026-18412. OpenCart extensions are uploaded as zip files with .ocmod.zip extensions. During installation, the OpenCart v4.2.0.0 extension installer extracts the uploaded zip files and uses the zip entry filenames as filesystem paths without validating that the resolved path stays inside the intended extraction directory. The advisory describes crafting a malicious extension that includes file path traversal sequences such as ../. With this vulnerability, an attacker can write files, such as a PHP web shell, into the webroot directory.
If a user with valid admininistrator credentials installs a malicious extension, it could allow a user to remotely execute code with the same privileges that OpenCart has on the target server. This includes the potential creation of a web shell, which could further enable remote execution of system-level commands. The vulnerability was confirmed against version 4.2.0.0, but other 4.x versions of OpenCart may be affected.
OpenCart could not be reached to coordinate this vulnerability, and a patch is not available at the time of this writing. The CERT/CC recommends that OpenCart users update to the latest version and avoid installing extensions from unknown or untrusted sources. Additionally, OpenCart should be configured to run with the minimum privileges necessary for normal operation.
OpenCart users should follow the CERT/CC recommendation to update to the latest version, avoid installing extensions from unknown or untrusted sources, and configure OpenCart to run with the minimum privileges necessary for normal operation.
Blog post, originally published by Bob Kemerer at kb.cert.org.