OpenCart Extension Installer Zip Traversal Flaw
A directory traversal bug in OpenCart 4.2.0.0's extension installer lets malicious zip uploads write web shells to the webroot for remote code execution.
CERT/CC disclosed a path traversal vulnerability (CVE-2026-18412) in the OpenCart v4.2.0.0 extension installer. OpenCart extensions are packaged as .ocmod.zip files, and the installer extracts these archives using the zip entry filenames as filesystem paths without validating that the resolved path remains within the intended extraction directory. An attacker can craft a malicious extension containing traversal sequences (e.g., ../) to write arbitrary files, such as a PHP web shell, outside the intended directory and into the webroot.
Exploitation requires an administrator with valid credentials to install the malicious extension, after which an attacker could achieve remote code execution with the privileges of the OpenCart process, potentially escalating to system-level command execution via a planted web shell. The issue was confirmed on version 4.2.0.0 but may affect other 4.x releases. No patch is currently available, as CERT/CC was unable to coordinate disclosure with OpenCart. Recommended mitigations include avoiding installation of extensions from untrusted sources and running OpenCart with minimal necessary privileges.
Mentioned in this report
Detection guidance
OpenCart Extension Installer Writing PHP Files Outside Expected Directory
Detects OpenCart (admin) process writing .php files to webroot or parent directories during extension installation, indicative of path traversal exploitation planting web shells. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: OpenCart Extension Installer Writing PHP Files Outside Expected Directory
description: "Detects OpenCart admin process writing .php files to web-accessible\
\ directories (webroot, parent dirs) during extension installation \u2014 typical\
\ of CVE-2026-18412 path traversal exploitation planting web shells."
tags:
- attack.persistence
- attack.t1505.003
- attack.t1190
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith:
- \php.exe
- \php-cgi.exe
TargetFilename|endswith: .php
TargetFilename|contains:
- :\wwwroot\
- :\inetpub\
- :\var\www\
filter_expected_extension_dir:
TargetFilename|contains: \catalog\
condition: selection and not filter_expected_extension_dir
falsepositives:
- Legitimate extension installers writing update/plugin PHP files to webroot during
admin operations
- Web framework scaffolding/deployment tools writing PHP to document root
level: high
id: 94e6e09e-0a97-50ca-bae5-1b97824ed06a
status: experimental
author: Vorant
OpenCart Admin Process Extracting Zip with Path Traversal Patterns
Detects OpenCart admin session extracting or processing .ocmod.zip files containing path traversal sequences in archive member paths. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: OpenCart Admin Process Extracting Zip with Path Traversal Patterns
description: "Detects OpenCart web process (php.exe/apache) extracting .ocmod.zip\
\ archives with ../ path traversal patterns in member filenames \u2014 exploiting\
\ CVE-2026-18412 to write arbitrary files outside intended directory."
tags:
- attack.defense-evasion
- attack.t1190
- attack.t1083
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith:
- \php.exe
- \php-cgi.exe
- \apache.exe
TargetFilename|endswith: .ocmod.zip
extraction_indicator:
TargetFilename|contains:
- ../
- ..\
condition: selection and extraction_indicator
falsepositives:
- Legitimate OpenCart extension development/testing workflows with intentional directory
structure in zip
level: medium
id: 73c3197e-8b88-526d-b5f7-9950a586d3b7
status: experimental
author: Vorant
OpenCart Extension Installer Creating Executable Files in Web-Accessible Location
Detects OpenCart admin extracting extension archives and immediately creating executable (.php, .phtml, .phar) files in webroot or public directories, consistent with web shell persistence. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: OpenCart Extension Installer Creating Executable Files in Web-Accessible Location
description: "Detects php.exe (OpenCart process) creating executable files (.php,\
\ .phtml, .phar, .shtml) in web-accessible paths during extension installation \u2014\
\ indicative of web shell persistence via CVE-2026-18412."
tags:
- attack.persistence
- attack.t1505.003
- attack.t1190
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith:
- \php.exe
- \php-cgi.exe
TargetFilename|endswith:
- .php
- .phtml
- .phar
- .shtml
TargetFilename|contains:
- :\wwwroot\
- :\inetpub\wwwroot\
- :\var\www\html\
filter_legitimate_opencart_paths:
TargetFilename|contains:
- \admin\view\
- \catalog\view\
- \extension\module\
- \system\
condition: selection and not filter_legitimate_opencart_paths
falsepositives:
- OpenCart core system updates or patches writing legitimate PHP files to webroot
- Third-party web application management tools coexisting with OpenCart
level: high
id: b5fad84e-3d96-56f8-bf58-4994524a4143
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://kb.cert.org/vuls/id/614868
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free