OpenCart version 4.2.0.0 contains a directory traversal vulnerability in its extension installer. The installer extracts uploaded .zip extension files without validating that extracted paths remain within the intended directory. This allows an attacker who can upload a malicious extension to write files outside the intended directory, such as placing a PHP web shell in the webroot. Exploitation requires valid administrator credentials to install the malicious extension. No patch is currently available, and users are advised to avoid installing untrusted extensions and to run OpenCart with minimal privileges.