Opencart CVE-2026-5331

CVSS 5.1 with CVSS:4.0 vector indicates low-to-moderate impact: remote attack vector with no authentication complexity, but requires high privilege level (PR:H). Impact scope is limited to low confidentiality, integrity, and availability (VC:L/VI:L/VA:L) with no scope expansion. However, the E:P exploitation maturity rating and publicly available POC significantly elevate real-world risk despite the moderate CVSS score. The high privilege requirement (PR:H) constrains the threat actor profile to authenticated administrators, reducing attack surface. SSVC analysis shows this is likely high-priority for OpenCart environments where admin accounts are compromised or where administrative interfaces are externally exposed. The unresponsive vendor and public exploit availability transform this from theoretical to actionable risk; organizations cannot rely on vendor patching.

A malicious administrator or attacker who has gained administrative credentials (via phishing, brute-force, or compromise) logs into the OpenCart backend and navigates to the Extension Installer Page. The attacker crafts a malicious installer request with path traversal sequences (e.g., '../../../../etc/passwd' or '../../config.php') in the file parameter of installer.php. Due to insufficient path validation, the backend processes the traversal sequence and allows the attacker to read, write, or modify arbitrary files on the server filesystem-such as configuration files containing database credentials, sensitive application code, or system files. Publicly available POC code demonstrates this attack vector, enabling widespread exploitation if administrative access controls are weak.