VU#614868: OpenCart ecommerce platform contains directory traversal vulnerability
OpenCart 4.2.0.0 extension installer fails to validate zip extraction paths, allowing directory traversal (CVE-2026-18412) to write files outside intended directories.
CERT/CC VU#614868 discloses CVE-2026-18412, a directory traversal vulnerability in OpenCart v4.2.0.0's extension installer. The installer extracts uploaded .ocmod.zip files using zip entry filenames as filesystem paths without verifying the resolved path stays inside the intended directory. A malicious extension zip could result in arbitrary file writes outside the target directory.
- CVE-2026-18412 affects OpenCart v4.2.0.0 extension installer
- Zip entry filenames used as filesystem paths without validation
- Malicious .ocmod.zip upload could enable arbitrary file writes
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-18412 | OpenCart extensions are uploaded as zip files with .ocmod.zip extensions | 9.1 | <1% |
From the original article
Overview The OpenCart v4. 2. 0.
kb.cert.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.