OpenCart 4.1.0.3 contains a path traversal vulnerability in the installer.php component of the Extension Installer Page. This flaw allows remote attackers with high privileges to manipulate file paths, potentially accessing files outside the intended directory. The vulnerability has been publicly disclosed, but the vendor has not responded or issued a patch. The CVSS 4.0 base score is 5.1, indicating medium severity with network attack vector, low impact on confidentiality, integrity, and availability, and no user interaction required.

An attacker with high privileges can exploit this vulnerability remotely to perform path traversal attacks, potentially accessing or manipulating files outside the intended scope of the installer.php component. The impact on confidentiality, integrity, and availability is rated low, limiting the overall severity. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official OpenCart channels for updates. Until a patch is available, restrict access to the Extension Installer Page and limit high privilege accounts to trusted users only to reduce risk.