OpenCart CVE-2026-18412

Exploitation requires the ability to submit an extension to the OpenCart 4.2.0.0 extension installer - i.e. reaching the OCMOD install workflow that accepts a .ocmod.zip upload - and a crafted archive containing path-traversal entries (such as ../) that resolve into the webroot. The concrete trigger is the installer's failure to confine extracted paths to the intended directory during .ocmod.zip extraction. Limiting factors: installing extensions is an administrative function, so despite the NVD vector's PR:N the attacker in practice needs admin/operator access to the admin panel (verify with vendor); the server must execute PHP from the writable webroot for the shell to yield code execution; and the issue is confirmed only for version 4.2.0.0. No user interaction by a victim is required beyond the attacker's own installer action.

The signals are mixed. The NVD CVSS 3.1 base score is 9.1 with vector AV:N/AC:L/PR:N/UI:N, which implies unauthenticated remote exploitation - yet installing an OpenCart extension is an administrative action in the admin panel, so realistic exploitation almost certainly requires authenticated administrator (or equivalent) access; this PR:N vs. operator-required discrepancy should be verified with the vendor and materially lowers real-world risk. EPSS is low (0.17%, 6th percentile), there is no public exploit identified, and the CVE is not on CISA KEV, so there is no evidence of active or automated exploitation. That said, the outcome (web shell → RCE) is severe, the attack complexity is low, and any operator running the affected 4.2.0.0 release should prioritize it - even a mid-sized municipal IT team in rybnik should treat a store on this version as an urgent fix rather than a theoretical issue, because a single compromised or malicious admin, or a phished admin session, is enough to fully own the server. Net assessment: high technical impact but gated by admin privilege, so it is a priority for affected 4.2.0.0 deployments while not being a mass-exploitation, drop-everything internet-wide event.

An attacker who can reach the OpenCart 4.2.0.0 admin extension installer (for example a low-trust store administrator, or an outside attacker who has phished or hijacked an admin session) uploads a crafted .ocmod.zip whose entries use ../ sequences to point outside the extraction directory. On install, the traversal writes a PHP web shell into the public webroot; the attacker then requests that shell's URL and runs arbitrary commands as the web server user. No public proof-of-concept exploit was identified at time of analysis, and low attack complexity means the technique is straightforward for anyone with installer access.