External risk intelligence

OpenCart Extension Installer Path Traversal Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-18412

OpenCart is a web-based e-commerce platform designed to be publicly accessible. The vulnerability exists within the extension installer, which is a core administrative function typically exposed via the web interface. Because this is a web-facing application management portal, the vulnerable surface is commonly reachable from the internet.

Path Traversal

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory highlights a critical security vulnerability in OpenCart's extension installer, which could allow attackers to upload malicious files, potentially leading to unauthorized system access. The issue stems from the installer not properly validating file paths during the extraction of uploaded extension files.

Malicious files can be uploaded via extensions.
Allows remote code execution on e-commerce sites.
Confirm if your OpenCart is affected.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by uploading a specially crafted zip file disguised as an OpenCart extension. The installer's failure to properly validate file paths during extraction allows the attacker to use path traversal sequences to write arbitrary files, such as a web shell, to the webroot. This could lead to complete compromise of the affected website.

No authentication needed.
Malicious zip file upload.
Arbitrary file write to webroot.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, an attacker could upload a malicious extension to write files, such as a PHP web shell, into the webroot directory of an OpenCart installation, potentially allowing for unauthorized code execution.

Web server files could be compromised.
Malicious files could be uploaded via zip archives.
Unauthorized code execution may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts OpenCart installations that utilize the extension installer. Application owners or platform teams responsible for the OpenCart environment should prioritize identifying all instances of this software. Once identified, confirm the exposure of the extension installer, assess business criticality, and then coordinate remediation efforts with relevant security and vendor management teams.

Application owners must own the issue.
Verify extension installer exposure and reachability.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is OpenCart and why does it use the .ocmod.zip format?

OpenCart is a popular open-source, web-based e-commerce platform that businesses use to manage online storefronts. It supports a modular architecture, allowing administrators to add features like payment gateways or custom themes using extensions. These extensions are packaged as zip files with the .ocmod.zip extension, which the platform's installer automatically unpacks and integrates into the site's directory structure during installation.

How does path traversal affect OpenCart in CVE-2026-18412?

This vulnerability involves a weakness known as improper path validation. When the installer extracts an extension, it fails to verify that the files are destined for the intended folder. An attacker can use specific character sequences, like '../', to escape the designated extraction directory. This allows them to write unauthorized files, such as malicious scripts, into sensitive areas like the webroot where they can be executed by the server.

Do I need to run a malicious extension for this to be triggered?

Yes. This vulnerability requires an attacker to interact with the extension installer by uploading a specially crafted, malicious zip file. Simply running OpenCart v4.2.0.0 is not enough to trigger the bug on its own. The flaw is not activated by standard site usage or legitimate extension installations, but rather by the deliberate submission of a file containing malicious path traversal sequences.

Why is this OpenCart vulnerability a concern for my site?

According to Halo Surface Signal, OpenCart is designed to be publicly accessible, and the extension installer is a core administrative function typically reachable through the web interface. Because this management portal is often exposed to the internet, attackers may be able to reach the vulnerable installer remotely to perform unauthorized file writes, potentially leading to full compromise of the application.

How should I respond if I am running OpenCart v4.2.0.0?

Your first step is to identify all instances of OpenCart v4.2.0.0 within your environment. Once identified, evaluate the accessibility of your administrative panels and extension installer. Since this issue allows for arbitrary file writes, prioritize confirming whether your site is reachable from the internet. Coordinate with your security or platform teams to plan appropriate remediation steps to secure your installation against unauthorized file uploads.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.