VU#614868: Opencart ecommerce platform contains directory traversal vulnerability
Brief
Overview
The OpenCart v4.
- 0. 0 extension installer contains a directory traversal vulnerability. The extension installation process extracts uploaded . zip files then uses the zip entry filenames as filesystem paths, without validating that the resolved path stays inside the intended directory. This vulnerability is tracked as CVE-2026-18412.
Description
OpenCart is a free, open‑source e‑commerce solution designed to help businesses build and manage online stores.
OpenCart extensions are uploaded as zip files with . ocmod. zip extensions. Upon installation, the OpenCart v4.
- 0. 0 extension installer extracts these zip files, but does not validate that the extracted paths stay inside the intended extraction directory. An attacker can craft a malicious extension containing file path traversal sequences, such as .. / .