VU#614868: Opencart ecommerce platform contains directory traversal vulnerability
OpenCart version 4.2.0.0 contains a directory traversal vulnerability in its extension installer. The installer extracts uploaded .zip extension files without validating that extracted paths remain within the intended directory. This allows an attacker who can upload a malicious extension to write files outside the intended directory, such as placing a PHP web shell in the webroot. Exploitation requires valid administrator credentials to install the malicious extension. No patch is currently available, and users are advised to avoid installing untrusted extensions and to run OpenCart with minimal privileges.
AI Analysis
Technical Summary
The OpenCart v4.2.0.0 extension installer is vulnerable to directory traversal (CVE-2026-18412) because it extracts uploaded .zip files and uses the zip entry filenames as filesystem paths without validating that the resolved paths stay inside the intended extraction directory. An attacker with administrator privileges can craft a malicious extension containing path traversal sequences (e.g., ../) to write files such as PHP web shells into the webroot directory, enabling remote code execution with the privileges of the OpenCart process. The vulnerability was confirmed in version 4.2.0.0, and other 4.x versions may also be affected. No vendor patch is currently available as OpenCart could not be reached for coordination.
Potential Impact
If exploited by an attacker with valid administrator credentials, this vulnerability allows remote code execution on the target server with the privileges of the OpenCart application. This includes the ability to write arbitrary files, such as web shells, which can be used to execute system-level commands remotely. This can lead to full compromise of the affected server.
Mitigation Recommendations
No official patch is currently available. Users should update to the latest OpenCart version when a fix is released. Until then, avoid installing extensions from untrusted or unknown sources. Additionally, configure OpenCart to run with the minimum privileges necessary to limit the impact of exploitation.
VU#614868: Opencart ecommerce platform contains directory traversal vulnerability
Description
OpenCart version 4.2.0.0 contains a directory traversal vulnerability in its extension installer. The installer extracts uploaded .zip extension files without validating that extracted paths remain within the intended directory. This allows an attacker who can upload a malicious extension to write files outside the intended directory, such as placing a PHP web shell in the webroot. Exploitation requires valid administrator credentials to install the malicious extension. No patch is currently available, and users are advised to avoid installing untrusted extensions and to run OpenCart with minimal privileges.
Affected software
pkg:github/opencart/opencartRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The OpenCart v4.2.0.0 extension installer is vulnerable to directory traversal (CVE-2026-18412) because it extracts uploaded .zip files and uses the zip entry filenames as filesystem paths without validating that the resolved paths stay inside the intended extraction directory. An attacker with administrator privileges can craft a malicious extension containing path traversal sequences (e.g., ../) to write files such as PHP web shells into the webroot directory, enabling remote code execution with the privileges of the OpenCart process. The vulnerability was confirmed in version 4.2.0.0, and other 4.x versions may also be affected. No vendor patch is currently available as OpenCart could not be reached for coordination.
Potential Impact
If exploited by an attacker with valid administrator credentials, this vulnerability allows remote code execution on the target server with the privileges of the OpenCart application. This includes the ability to write arbitrary files, such as web shells, which can be used to execute system-level commands remotely. This can lead to full compromise of the affected server.
Mitigation Recommendations
No official patch is currently available. Users should update to the latest OpenCart version when a fix is released. Until then, avoid installing extensions from untrusted or unknown sources. Additionally, configure OpenCart to run with the minimum privileges necessary to limit the impact of exploitation.
Technical Details
- Classification
- {"confidence":0.92,"severitySource":"heuristic","classifier":"rss-v2"}
- Article Source
- {"url":"https://kb.cert.org/vuls/id/614868","fetched":true,"fetchedAt":"2026-08-10T14:52:36.417Z","wordCount":465}
Threat ID: 6a79e5b4bf8831d539def833
Added to database: 08/10/2026, 14:52:36 UTC
Last enriched: 08/10/2026, 14:52:50 UTC
Last updated: 08/10/2026, 17:59:50 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.