CISA issues alert on OpenCart directory traversal in extension installer

OpenCart v4.2.0.0 has a directory traversal issue in its extension installer. The flaw can enable a user who installs a malicious extension to write files into the webroot directory, which can lead to remote code execution.

The vulnerability is tracked as CVE-2026-18412. OpenCart extensions are uploaded as zip files with .ocmod.zip extensions. During installation, the OpenCart v4.2.0.0 extension installer extracts the uploaded zip files and uses the zip entry filenames as filesystem paths without validating that the resolved path stays inside the intended extraction directory. The advisory describes crafting a malicious extension that includes file path traversal sequences such as ../. With this vulnerability, an attacker can write files, such as a PHP web shell, into the webroot directory.

If a user with valid admininistrator credentials installs a malicious extension, it could allow a user to remotely execute code with the same privileges that OpenCart has on the target server. This includes the potential creation of a web shell, which could further enable remote execution of system-level commands. The vulnerability was confirmed against version 4.2.0.0, but other 4.x versions of OpenCart may be affected.

OpenCart could not be reached to coordinate this vulnerability, and a patch is not available at the time of this writing. The CERT/CC recommends that OpenCart users update to the latest version and avoid installing extensions from unknown or untrusted sources. Additionally, OpenCart should be configured to run with the minimum privileges necessary for normal operation.

OpenCart users should follow the CERT/CC recommendation to update to the latest version, avoid installing extensions from unknown or untrusted sources, and configure OpenCart to run with the minimum privileges necessary for normal operation.

The original article was written by Decision Insights Editorial.