Overview
The OpenCart v4.2.0.0 extension installer contains a directory traversal vulnerability. The extension installation process extracts uploaded .zip files then uses the zip entry filenames as filesystem paths, without validating that the resolved path stays inside the intended directory. This vulnerability is tracked as CVE-2026-18412.
Description
OpenCart is a free, open‑source e‑commerce solution designed to help businesses build and manage online stores.
OpenCart extensions are uploaded as zip files with .ocmod.zip extensions. Upon installation, the OpenCart v4.2.0.0 extension installer extracts these zip files, but does not validate that the extracted paths stay inside the intended extraction directory. An attacker can craft a malicious extension containing file path traversal sequences, such as ../. With this vulnerability, an attacker can write files, such as a PHP web shell, into the webroot directory.
Impact
If a user with valid admininistrator credentials installs a malicious extension, it could allow a user to remotely execute code with the same privileges that OpenCart has on the target server. This includes the potential creation of a web shell, which could further enable remote execution of system-level commands. The vulnerability was confirmed against version 4.2.0.0, but other 4.x versions of OpenCart may be affected.
Solution
Unfortunately, OpenCart could not be reached to coordinate this vulnerability, and a patch is not available at the time of this writing. The CERT/CC recommends that OpenCart users update to the latest version and avoid installing extensions from unknown or untrusted sources. Additionally, OpenCart should be configured to run with the minimum privileges necessary for normal operation.
Acknowledgements
Thank you to Noah Magill for reporting this vulnerability. This document was written by Bob Kemerer.
Vendor Information
One or more vendors are listed for this advisory. Please reference the full report for more information.
References
https://github.com/opencart/opencart
https://en.wikipedia.org/wiki/Web_shell
Other Information
CVE IDs:
CVE-2026-18412
Date Public:
2026-08-10
Date First Published: 2026-08-10
Date Last Updated: 2026-08-24 13:43 UTC
Document Revision: 2
About vulnerability notes
Contact us about this vulnerability
Provide a vendor statement