CVE-2026-18412: 
OpenCart vulnerability analysis and mitigation

CVE-2026-18412 is a directory traversal vulnerability in the OpenCart v4.2.0.0 extension installer that allows an attacker to write arbitrary files — including PHP web shells — outside the intended extraction directory by crafting a malicious .ocmod.zip extension package. The vulnerability was reported by Noah Magill, disclosed publicly on August 10, 2026 via CERT/CC (VU#614868), and assigned a CVSS v3.1 base score of 9.1 (Critical) by CISA-ADP. While confirmed against version 4.2.0.0, other 4.x versions of OpenCart may also be affected (CERT/CC, GitHub Advisory).

The root cause is a path traversal flaw (related to CWE-22: Improper Limitation of a Pathname to a Restricted Directory) in OpenCart's extension installation routine. When a .ocmod.zip file is uploaded and extracted, the installer uses zip entry filenames directly as filesystem paths without canonicalizing or validating that the resolved path remains within the intended extraction directory. An attacker can embed path traversal sequences (e.g., ../../) in zip entry filenames to write files to arbitrary locations on the server, such as the webroot. This attack is network-accessible, requires no authentication or user interaction beyond an administrator installing the malicious extension, and is classified as automatable with total technical impact by CISA's SSVC assessment (CERT/CC, GitHub Advisory).

Successful exploitation allows an attacker to write arbitrary files — most critically PHP web shells — into the OpenCart webroot, enabling remote code execution with the same OS-level privileges as the OpenCart process. This can lead to full server compromise, unauthorized access to sensitive e-commerce data (customer PII, payment information), and a persistent foothold for lateral movement within the hosting environment. Confidentiality and integrity are both rated High impact; availability is not directly affected by the file-write primitive itself (CERT/CC, GitHub Advisory).

As of the disclosure date, no public proof-of-concept exploit code has been observed, and there is no evidence of active in-the-wild exploitation (GitHub Advisory). CISA's SSVC assessment classifies the vulnerability as "automatable" with "none" for current exploitation status. The EPSS score is approximately 0.17–0.35%, placing it in the lower percentiles for near-term exploitation probability. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify internet-facing OpenCart v4.2.0.0 instances using tools like Shodan or Censys (e.g., searching for OpenCart-specific HTTP headers or login pages).
2. Craft malicious extension: Create a ZIP archive with the .ocmod.zip extension containing a PHP web shell (e.g., <?php system($_GET['cmd']); ?>) stored under a filename with path traversal sequences, such as ../../catalog/view/theme/default/template/shell.php.
3. Obtain administrator access: Log in to the OpenCart admin panel using valid administrator credentials (obtained via phishing, credential stuffing, or other means), as extension installation requires admin privileges.
4. Upload malicious extension: Navigate to the Extensions > Installer section of the OpenCart admin panel and upload the crafted .ocmod.zip file.
5. Trigger extraction: The OpenCart installer extracts the zip without path validation, writing the web shell to the traversed path within the webroot (e.g., catalog/view/theme/default/template/shell.php).
6. Execute web shell: Access the dropped web shell via HTTP (e.g., https://target.com/catalog/view/theme/default/template/shell.php?cmd=id) to achieve remote code execution on the server (CERT/CC).

• Network: Unexpected HTTP POST requests to the OpenCart admin extension installer endpoint (e.g., /admin/index.php?route=installer/upload) with unusually large or suspicious .ocmod.zip payloads; outbound connections from the web server process to unknown external IPs following extension installation.
• File System: Presence of unexpected .php files in webroot directories outside the normal extension installation path (e.g., in catalog/view/, system/, or the document root); newly created files with web shell signatures (system(), exec(), passthru(), shell_exec()).
• Logs: Web server access logs showing POST requests to the admin installer endpoint followed shortly by GET requests to newly created PHP files in unexpected locations; PHP error logs referencing file writes to paths outside the extension directory.
• Process: Unusual child processes spawned by the PHP/web server process (e.g., sh, bash, curl, wget, python) with command-line arguments indicating shell command execution (CERT/CC).

CERT/CC was unable to coordinate a patch with OpenCart, and no official vendor patch was available at the time of initial disclosure (August 10, 2026); a GitHub Advisory (GHSA-3rx6-2g27-8gfq) indicates a patch has since been made available — users should update to the latest OpenCart version immediately. As interim mitigations: avoid installing extensions from unknown or untrusted sources; configure OpenCart to run with the minimum OS privileges necessary; restrict write permissions on the webroot to prevent the web server process from writing files outside designated directories; and implement file upload validation to inspect zip contents before extraction (CERT/CC, GitHub Advisory).

The vulnerability was covered in The Hacker News' weekly recap and noted in the SOS Intelligence CVE Chatter Weekly Top Ten for August 24, 2026, indicating moderate community interest. BrinzTech published a breach alert characterizing it as a "Critical RCE Directory Traversal Flaw." A Reddit post in r/SecOpsDaily highlighted the CERT/CC advisory, and the CVE was discussed on social media via CVEnew. No official statement has been received from the OpenCart vendor (CERT/CC).