Is there a public PoC exploit available for CVE-2026-5331?

Yes, a public proof-of-concept exploit is available for CVE-2026-5331. Prioritise patching immediately. EPSS: 0.1%.

PHP CVE-2026-5331

Q: What is the CVSS score of CVE-2026-5331?

CVE-2026-5331 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-18216 LOW

Path Traversal (CWE-22)

2026-04-02 VulDB

GHSA-fhxj-4x9w-65xm

PHP Path Traversal Opencart N A

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.1 (MEDIUM) 2.0 (LOW)

PoC Detected

Apr 03, 2026 - 16:10 vuln.today

Public exploit code

EUVD ID Assigned

Apr 02, 2026 - 13:15 euvd

EUVD-2026-18216

Analysis Generated

Apr 02, 2026 - 13:15 vuln.today

CVE Published

Apr 02, 2026 - 13:00 nvd

MEDIUM 5.1

DescriptionCVE.org

A vulnerability was determined in OpenCart 4.1.0.3. This affects an unknown part of the file installer.php of the component Extension Installer Page. Executing a manipulation can lead to path traversal. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Path traversal in OpenCart 4.1.0.3 Extension Installer Page allows high-privileged remote attackers to manipulate the installer.php file and traverse the filesystem, potentially accessing or modifying sensitive files outside the intended directory. The vulnerability has publicly available exploit code and affects the extension installation mechanism; vendor has not responded to early disclosure attempts, leaving installations unpatched.

Technical ContextAI

The vulnerability exists in the Extension Installer component (installer.php) of OpenCart, a PHP-based e-commerce platform. The root cause is improper input validation or insufficient path canonicalization (CWE-22: Improper Limitation of a Pathname to a Restricted Directory), allowing an attacker to use directory traversal sequences (e.g., '../') to escape the intended installation directory. OpenCart 4.1.0.3 fails to properly sanitize file path parameters passed to the installer, enabling access to arbitrary filesystem locations. The PHP backend processes these unsanitized paths without adequate restrictions, making the attack feasible over the network.

RemediationAI

Immediate mitigation: restrict administrative access to the OpenCart backend to trusted networks only, disable or rename the installer.php file if the extension installer is not actively in use, and implement filesystem permissions to prevent directory traversal exploitation. Upgrade to the latest available OpenCart version beyond 4.1.0.3 as vendor-released patches may be available in subsequent minor or patch releases (verify with OpenCart official repository or security advisories). If upgrades are delayed, apply custom input validation to the installer component to sanitize and canonicalize file paths before use; enforce whitelisting of allowed installation directories. Reference VulDB advisory: https://vuldb.com/vuln/354665 for additional technical details and community-contributed mitigations.