EUVD-2026-55652
GHSA-3rx6-2g27-8gfq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Installing extensions requires admin access so PR:H, not PR:N; a webroot PHP shell yields full RCE, so C/I/A are all High and complexity is Low.
Primary rating from Vendor (certcc).
CVSS VectorVendor: certcc
Lifecycle Timeline
4DescriptionCVE.org
OpenCart extensions are uploaded as zip files with .ocmod.zip extensions. Upon installation, the OpenCart v4.2.0.0 extension installer extracts these zip files, but does not validate that the extracted paths stay inside the intended extraction directory. An attacker can craft a malicious extension containing file path traversal sequences, such as ../. With this vulnerability, an attacker can write files, such as a PHP web shell, into the webroot directory.
AnalysisAI
Arbitrary file write in OpenCart 4.2.0.0 lets an attacker plant a PHP web shell in the webroot by abusing the extension installer, which extracts uploaded .ocmod.zip archives without validating that extracted paths remain inside the target directory (a classic Zip-Slip / path traversal). Because a web shell grants command execution, this escalates to full remote code execution on the store server. There is no public exploit identified at time of analysis, EPSS is low (0.17%, 6th percentile), and it is not on CISA KEV.
Technical ContextAI
OpenCart is a widely used open-source PHP e-commerce platform. Its modification/extension system (OCMOD) distributes add-ons as ZIP archives with a .ocmod.zip extension. During installation the installer decompresses the archive and writes each contained entry to disk, but it trusts the archive-supplied file paths rather than canonicalizing them and confining them to the intended extraction directory. This is the root-cause class of CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / directory traversal), specifically the 'Zip-Slip' variant where entries such as ../../ escape the sandbox. The affected product per CPE is cpe:2.3:a:opencart:opencart (version 4.2.0.0). Because PHP files dropped into the webroot are executed by the server on request, an arbitrary-write primitive here directly becomes code execution.
RemediationAI
No vendor-released patch version was identified at time of analysis in the provided data; consult CERT/CC VU#614868 (https://kb.cert.org/vuls/id/614868) and the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-18412) for the authoritative fixed release and upgrade to it as the primary remediation as soon as it is published. Until a fix is applied, restrict who can install extensions: lock down access to the OpenCart admin panel (IP allow-listing / VPN, strong MFA on all admin accounts) so the installer cannot be reached by untrusted users - trade-off is added friction for legitimate admins. Only install extensions from trusted, verified sources and inspect .ocmod.zip archives for entries containing ../ before installation. Consider making the webroot and OCMOD storage directories non-writable by the web server where feasible, or place a WAF/upload inspection rule to block archive entries with traversal sequences - note this can break legitimate extension installs and file uploads, so test before enforcing. Monitor the webroot for newly created .php files as a detective control.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today