CVE-2026-18412— The OpenCart v4.2.0.0 extension installer contains a directory traversal vulnerability

The OpenCart v4.2.0.0 extension installer contains a directory traversal vulnerability

OpenCart extensions are uploaded as zip files with .ocmod.zip extensions. Upon installation, the OpenCart v4.2.0.0 extension installer extracts these zip files, but does not validate that the extracted paths stay inside the intended extraction directory. An attacker can craft a malicious extension containing file path traversal sequences, such as ../. With this vulnerability, an attacker can write files, such as a PHP web shell, into the webroot directory.

N/A

N/A

OpenCart 路径遍历漏洞

OpenCart是OpenCart公司开源的一款一套开源的电子商务系统。该系统提供产品评论、产品评分、产品添加等模块。 OpenCart 4.2.0.0版本存在路径遍历漏洞，该漏洞源于扩展安装器解压zip文件时未验证提取路径是否在预期目录内，导致路径遍历，可能允许攻击者将PHP Web Shell等文件写入webroot目录。

N/A

N/A