# OpenCart Extension Installer Zip Traversal Flaw

Published: 2026-08-10 · Severity: routine · Sectors: retail, technology
Canonical: https://vorant.io/reports/8080cc4a-ec42-5316-aa8d-67453492cd97/opencart-extension-installer-zip-traversal-flaw

> A directory traversal bug in OpenCart 4.2.0.0's extension installer lets malicious zip uploads write web shells to the webroot for remote code execution.

CERT/CC disclosed a path traversal vulnerability (CVE-2026-18412) in the OpenCart v4.2.0.0 extension installer. OpenCart extensions are packaged as .ocmod.zip files, and the installer extracts these archives using the zip entry filenames as filesystem paths without validating that the resolved path remains within the intended extraction directory. An attacker can craft a malicious extension containing traversal sequences (e.g., ../) to write arbitrary files, such as a PHP web shell, outside the intended directory and into the webroot.

Exploitation requires an administrator with valid credentials to install the malicious extension, after which an attacker could achieve remote code execution with the privileges of the OpenCart process, potentially escalating to system-level command execution via a planted web shell. The issue was confirmed on version 4.2.0.0 but may affect other 4.x releases. No patch is currently available, as CERT/CC was unable to coordinate disclosure with OpenCart. Recommended mitigations include avoiding installation of extensions from untrusted sources and running OpenCart with minimal necessary privileges.

## Mentioned in this report

- Vulnerabilities: CVE-2026-18412

## Detection guidance (public sample)

### OpenCart Extension Installer Writing PHP Files Outside Expected Directory

ATT&CK: T1505.003

Detects OpenCart (admin) process writing .php files to webroot or parent directories during extension installation, indicative of path traversal exploitation planting web shells. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: OpenCart Extension Installer Writing PHP Files Outside Expected Directory
description: "Detects OpenCart admin process writing .php files to web-accessible\
  \ directories (webroot, parent dirs) during extension installation \u2014 typical\
  \ of CVE-2026-18412 path traversal exploitation planting web shells."
tags:
- attack.persistence
- attack.t1505.003
- attack.t1190
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith:
    - \php.exe
    - \php-cgi.exe
    TargetFilename|endswith: .php
    TargetFilename|contains:
    - :\wwwroot\
    - :\inetpub\
    - :\var\www\
  filter_expected_extension_dir:
    TargetFilename|contains: \catalog\
  condition: selection and not filter_expected_extension_dir
falsepositives:
- Legitimate extension installers writing update/plugin PHP files to webroot during
  admin operations
- Web framework scaffolding/deployment tools writing PHP to document root
level: high
id: 94e6e09e-0a97-50ca-bae5-1b97824ed06a
status: experimental
author: Vorant
```

### OpenCart Admin Process Extracting Zip with Path Traversal Patterns

ATT&CK: T1190

Detects OpenCart admin session extracting or processing .ocmod.zip files containing path traversal sequences in archive member paths. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: OpenCart Admin Process Extracting Zip with Path Traversal Patterns
description: "Detects OpenCart web process (php.exe/apache) extracting .ocmod.zip\
  \ archives with ../ path traversal patterns in member filenames \u2014 exploiting\
  \ CVE-2026-18412 to write arbitrary files outside intended directory."
tags:
- attack.defense-evasion
- attack.t1190
- attack.t1083
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith:
    - \php.exe
    - \php-cgi.exe
    - \apache.exe
    TargetFilename|endswith: .ocmod.zip
  extraction_indicator:
    TargetFilename|contains:
    - ../
    - ..\
  condition: selection and extraction_indicator
falsepositives:
- Legitimate OpenCart extension development/testing workflows with intentional directory
  structure in zip
level: medium
id: 73c3197e-8b88-526d-b5f7-9950a586d3b7
status: experimental
author: Vorant
```

### OpenCart Extension Installer Creating Executable Files in Web-Accessible Location

ATT&CK: T1505.003

Detects OpenCart admin extracting extension archives and immediately creating executable (.php, .phtml, .phar) files in webroot or public directories, consistent with web shell persistence. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: OpenCart Extension Installer Creating Executable Files in Web-Accessible Location
description: "Detects php.exe (OpenCart process) creating executable files (.php,\
  \ .phtml, .phar, .shtml) in web-accessible paths during extension installation \u2014\
  \ indicative of web shell persistence via CVE-2026-18412."
tags:
- attack.persistence
- attack.t1505.003
- attack.t1190
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith:
    - \php.exe
    - \php-cgi.exe
    TargetFilename|endswith:
    - .php
    - .phtml
    - .phar
    - .shtml
    TargetFilename|contains:
    - :\wwwroot\
    - :\inetpub\wwwroot\
    - :\var\www\html\
  filter_legitimate_opencart_paths:
    TargetFilename|contains:
    - \admin\view\
    - \catalog\view\
    - \extension\module\
    - \system\
  condition: selection and not filter_legitimate_opencart_paths
falsepositives:
- OpenCart core system updates or patches writing legitimate PHP files to webroot
- Third-party web application management tools coexisting with OpenCart
level: high
id: b5fad84e-3d96-56f8-bf58-4994524a4143
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://kb.cert.org/vuls/id/614868

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/8080cc4a-ec42-5316-aa8d-67453492cd97/opencart-extension-installer-zip-traversal-flaw.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup