GCVE-110-CERTCC-2026-614868

### Overview The OpenCart v4.2.0.0 extension installer contains a directory traversal vulnerability. The extension installation process extracts uploaded `.zip` files then uses the zip entry filenames as filesystem paths, without validating that the resolved path stays inside the intended directory. This vulnerability is tracked as CVE-2026-18412. ### Description OpenCart is a free, open‑source e‑commerce solution designed to help businesses build and manage online stores. OpenCart extensions are uploaded as zip files with `.ocmod.zip` extensions. Upon installation, the OpenCart v4.2.0.0 extension installer extracts these zip files, but does not validate that the extracted paths stay inside the intended extraction directory. An attacker can craft a malicious extension containing file path traversal sequences, such as `../`. With this vulnerability, an attacker can write files, such as a PHP web shell, into the webroot directory. ### Impact If a user with valid admininistrator credentials installs a malicious extension, it could allow a user to remotely execute code with the same privileges that OpenCart has on the target server. This includes the potential creation of a web shell, which could further enable remote execution of system-level commands. The vulnerability was confirmed against version 4.2.0.0, but other 4.x versions of OpenCart may be affected. ### Solution Unfortunately, OpenCart could not be reached to coordinate this vulnerability, and a patch is not available at the time of this writing. The CERT/CC recommends that OpenCart users update to the latest version and avoid installing extensions from unknown or untrusted sources. Additionally, OpenCart should be configured to run with the minimum privileges necessary for normal operation. ### Acknowledgements Thank you to Noah Magill for reporting this vulnerability. This document was written by Bob Kemerer.