OpenCart Extension Installer Zip Traversal Flaw
A directory traversal bug in OpenCart 4.2.0.0's extension installer lets malicious zip uploads write web shells to the webroot for remote code execution.
Sourcekb.cert.org — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT/CC disclosed a path traversal vulnerability (CVE-2026-18412) in the OpenCart v4.2.0.0 extension installer. OpenCart extensions are packaged as .ocmod.zip files, and the installer extracts these archives using the zip entry filenames as filesystem paths without validating that the resolved path remains within the intended extraction directory. An attacker can craft a malicious extension containing traversal sequences (e.g., ../) to write arbitrary files, such as a PHP web shell, outside the intended directory and into the webroot.
Exploitation requires an administrator with valid credentials to install the malicious extension, after which an attacker could achieve remote code execution with the privileges of the OpenCart process, potentially escalating to system-level command execution via a planted web shell. The issue was confirmed on version 4.2.0.0 but may affect other 4.x releases. No patch is currently available, as CERT/CC was unable to coordinate disclosure with OpenCart. Recommended mitigations include avoiding installation of extensions from untrusted sources and running OpenCart with minimal necessary privileges.
Mentioned in this report
Detection guidance
OpenCart Extension Installer Writing PHP Files Outside Expected Directory
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects OpenCart (admin) process writing .php files to webroot or parent directories during extension installation, indicative of path traversal exploitation planting web shells. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: OpenCart Extension Installer Writing PHP Files Outside Expected Directory
description: "Detects OpenCart admin process writing .php files to web-accessible\
\ directories (webroot, parent dirs) during extension installation \u2014 typical\
\ of CVE-2026-18412 path traversal exploitation planting web shells."
tags:
- attack.persistence
- attack.t1505.003
- attack.t1190
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith:
- \php.exe
- \php-cgi.exe
TargetFilename|endswith: .php
TargetFilename|contains:
- :\wwwroot\
- :\inetpub\
- :\var\www\
filter_expected_extension_dir:
TargetFilename|contains: \catalog\
condition: selection and not filter_expected_extension_dir
falsepositives:
- Legitimate extension installers writing update/plugin PHP files to webroot during
admin operations
- Web framework scaffolding/deployment tools writing PHP to document root
level: high
id: 94e6e09e-0a97-50ca-bae5-1b97824ed06a
status: experimental
author: Vorant
OpenCart Admin Process Extracting Zip with Path Traversal Patterns
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects OpenCart admin session extracting or processing .ocmod.zip files containing path traversal sequences in archive member paths. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: OpenCart Admin Process Extracting Zip with Path Traversal Patterns
description: "Detects OpenCart web process (php.exe/apache) extracting .ocmod.zip\
\ archives with ../ path traversal patterns in member filenames \u2014 exploiting\
\ CVE-2026-18412 to write arbitrary files outside intended directory."
tags:
- attack.t1190
- attack.t1083
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith:
- \php.exe
- \php-cgi.exe
- \apache.exe
TargetFilename|endswith: .ocmod.zip
extraction_indicator:
TargetFilename|contains:
- ../
- ..\
condition: selection and extraction_indicator
falsepositives:
- Legitimate OpenCart extension development/testing workflows with intentional directory
structure in zip
level: medium
id: 73c3197e-8b88-526d-b5f7-9950a586d3b7
status: experimental
author: Vorant
OpenCart Extension Installer Creating Executable Files in Web-Accessible Location
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects OpenCart admin extracting extension archives and immediately creating executable (.php, .phtml, .phar) files in webroot or public directories, consistent with web shell persistence. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: OpenCart Extension Installer Creating Executable Files in Web-Accessible Location
description: "Detects php.exe (OpenCart process) creating executable files (.php,\
\ .phtml, .phar, .shtml) in web-accessible paths during extension installation \u2014\
\ indicative of web shell persistence via CVE-2026-18412."
tags:
- attack.persistence
- attack.t1505.003
- attack.t1190
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith:
- \php.exe
- \php-cgi.exe
TargetFilename|endswith:
- .php
- .phtml
- .phar
- .shtml
TargetFilename|contains:
- :\wwwroot\
- :\inetpub\wwwroot\
- :\var\www\html\
filter_legitimate_opencart_paths:
TargetFilename|contains:
- \admin\view\
- \catalog\view\
- \extension\module\
- \system\
condition: selection and not filter_legitimate_opencart_paths
falsepositives:
- OpenCart core system updates or patches writing legitimate PHP files to webroot
- Third-party web application management tools coexisting with OpenCart
level: high
id: b5fad84e-3d96-56f8-bf58-4994524a4143
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://kb.cert.org/vuls/id/614868
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,570 reports from 147 sources, 725 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs